Identity Threat Radar

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 4 Oct 2026.

NVD record for CVE-2026-104286 →

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 3 Oct 2026.

NVD record for CVE-2026-76504 →

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 30 Sep 2026.

NVD record for CVE-2026-88771 →

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 19 Sep 2026.

NVD record for CVE-2026-76460 →

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 17 Sep 2026.

NVD record for CVE-2026-76461 →

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 25 Sep 2026.

NVD record for CVE-2026-42018 →

MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 13 Sep 2026.

NVD record for CVE-2026-67277 →

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 12 Sep 2026.

NVD record for CVE-2026-20079 →

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 12 Sep 2026.

NVD record for CVE-2026-19490 →

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 11 Sep 2026.

NVD record for CVE-2026-86218 →

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Sep 2026.

NVD record for CVE-2026-83548 →

JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Sep 2026.

NVD record for CVE-2026-82329 →

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 16 Sep 2026.

NVD record for CVE-2026-59822 →

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Sep 2026.

NVD record for CVE-2026-49869 →

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 14 Sep 2026.

NVD record for CVE-2026-81578 →

ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 30 Aug 2026.

NVD record for CVE-2023-49105 →

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 23 Aug 2026.

NVD record for CVE-2026-72529 →

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 21 Aug 2026.

NVD record for CVE-2026-65400 →

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

The original N-central bypass, added to KEV a day after its successor. RMM platforms are the auth boundary for every customer downstream of them.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 7 Aug 2026.

NVD record for CVE-2026-18556 →

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

Pre-auth and internet-facing by default. The story is that this is the second patch. 18556 didn't hold.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 6 Aug 2026.

NVD record for CVE-2026-18577 →

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Persistence, not initial access. It defeats the patch meant to evict attackers already inside FortiOS. Patching alone doesn't answer the compromise question.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 10 Aug 2026.

NVD record for CVE-2025-68686 →

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

An unauthenticated remote attacker can mint an admin login token. CISA gave federal agencies three days, which tells you how it rates token issuance.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 25 Jul 2026.

NVD record for CVE-2026-16232 →

Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

The second FortiSandbox command-injection entry added the same day. Two at once reads as sustained attacker attention on the product, not a one-off.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 19 Jul 2026.

NVD record for CVE-2026-39808 →

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

Unauthenticated command execution in the appliance you feed malware to. Security tooling is internet-adjacent by design, which makes it a target by default.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 19 Jul 2026.

NVD record for CVE-2026-25089 →

Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Missing authentication on a critical SharePoint function. On-prem SharePoint keeps earning its place here, and the compensating control is not being internet-facing.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 17 Jul 2026.

NVD record for CVE-2026-56164 →

SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.

Already in ransomware campaigns. SSRF on the SSO gateway lets attackers reach whatever the appliance can, and that is everything behind it.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 17 Jul 2026.

NVD record for CVE-2026-15409 →

Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 28 Jun 2026.

NVD record for CVE-2026-20230 →

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 21 Jun 2026.

NVD record for CVE-2026-20253 →

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 15 Jun 2026.

NVD record for CVE-2026-35273 →

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 14 Jun 2026.

NVD record for CVE-2026-10520 →

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Jun 2026.

NVD record for CVE-2026-50751 →

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 19 Jun 2026.

NVD record for CVE-2026-28318 →

Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 5 Jun 2026.

NVD record for CVE-2022-0492 →

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

CISA Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Federal deadline 17 May 2026.

NVD record for CVE-2026-20182 →

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 3 May 2026.

NVD record for CVE-2026-41940 →

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 7 May 2026.

NVD record for CVE-2026-39987 →

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 4 May 2026.

NVD record for CVE-2025-32975 →

PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 4 May 2026.

NVD record for CVE-2023-27351 →

Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Apr 2026.

NVD record for CVE-2026-21643 →

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 9 Apr 2026.

NVD record for CVE-2026-35616 →

Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 8 Apr 2026.

NVD record for CVE-2026-33017 →

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 22 Mar 2026.

NVD record for CVE-2026-20131 →

Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Mar 2026.

NVD record for CVE-2026-1603 →

Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 26 Mar 2026.

NVD record for CVE-2017-7921 →

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

CISA Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Federal deadline 27 Feb 2026.

NVD record for CVE-2026-20127 →

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Feb 2026.

NVD record for CVE-2026-1731 →

SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Feb 2026.

NVD record for CVE-2025-40536 →

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 26 Feb 2026.

NVD record for CVE-2026-24423 →

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 6 Feb 2026.

NVD record for CVE-2025-40551 →

Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 24 Feb 2026.

NVD record for CVE-2019-19006 →

Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 30 Jan 2026.

NVD record for CVE-2026-24858 →

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Feb 2026.

NVD record for CVE-2026-23760 →

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Feb 2026.

NVD record for CVE-2025-34026 →

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Dec 2025.

NVD record for CVE-2025-61757 →

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Nov 2025.

NVD record for CVE-2025-64446 →

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 10 Nov 2025.

NVD record for CVE-2025-2747 →

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 10 Nov 2025.

NVD record for CVE-2025-2746 →

SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 4 Nov 2025.

NVD record for CVE-2016-7836 →

Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Oct 2025.

NVD record for CVE-2025-4008 →

Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Oct 2025.

NVD record for CVE-2015-7755 →

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 24 Sep 2025.

NVD record for CVE-2023-50224 →

TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Sep 2025.

NVD record for CVE-2020-24363 →

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 19 Sep 2025.

NVD record for CVE-2025-57819 →

Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

CISA Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. Federal deadline 23 Jul 2025.

NVD record for CVE-2025-49706 →

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 8 Aug 2025.

NVD record for CVE-2025-25257 →

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Jul 2025.

NVD record for CVE-2024-54085 →

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 30 Jun 2025.

NVD record for CVE-2025-32433 →

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Jun 2025.

NVD record for CVE-2025-3935 →

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Jun 2025.

NVD record for CVE-2021-32030 →

Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 9 Jun 2025.

NVD record for CVE-2025-4427 →

Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 4 Jun 2025.

NVD record for CVE-2025-32756 →

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 26 May 2025.

NVD record for CVE-2025-3248 →

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

CISA Apply mitigations as set forth in the CISA instructions linked below. Federal deadline 11 Apr 2025.

NVD record for CVE-2025-22457 →

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Apr 2025.

NVD record for CVE-2024-20439 →

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 8 Apr 2025.

NVD record for CVE-2025-24472 →

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 31 Mar 2025.

NVD record for CVE-2024-13161 →

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 31 Mar 2025.

NVD record for CVE-2024-13160 →

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 31 Mar 2025.

NVD record for CVE-2024-13159 →

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Mar 2025.

NVD record for CVE-2025-0108 →

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Mar 2025.

NVD record for CVE-2024-53704 →

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 6 Mar 2025.

NVD record for CVE-2024-57727 →

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 14 Feb 2025.

NVD record for CVE-2025-23006 →

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Jan 2025.

NVD record for CVE-2024-55591 →

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 27 Dec 2024.

NVD record for CVE-2024-12356 →

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

CISA The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Federal deadline 8 Jan 2025.

NVD record for CVE-2022-23227 →

ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 24 Dec 2024.

NVD record for CVE-2024-11680 →

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Dec 2024.

NVD record for CVE-2023-28461 →

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 9 Dec 2024.

NVD record for CVE-2024-0012 →

Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 3 Dec 2024.

NVD record for CVE-2024-49039 →

Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 28 Nov 2024.

NVD record for CVE-2024-5910 →

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 25 Nov 2024.

NVD record for CVE-2024-8956 →

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 13 Nov 2024.

NVD record for CVE-2024-47575 →

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 30 Oct 2024.

NVD record for CVE-2024-23113 →

Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Oct 2024.

NVD record for CVE-2024-29824 →

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Oct 2024.

NVD record for CVE-2024-7593 →

Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.

CISA As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates. Federal deadline 10 Oct 2024.

NVD record for CVE-2024-8963 →

Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Sep 2024.

NVD record for CVE-2021-33045 →

Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Sep 2024.

NVD record for CVE-2021-33044 →

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 4 Jul 2024.

NVD record for CVE-2024-4358 →

Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Apr 2024.

NVD record for CVE-2023-48788 →

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Apr 2024.

NVD record for CVE-2021-44529 →

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 28 Mar 2024.

NVD record for CVE-2024-27198 →

ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 29 Feb 2024.

NVD record for CVE-2024-1709 →

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 7 Mar 2024.

NVD record for CVE-2024-21410 →

Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Feb 2024.

NVD record for CVE-2024-21762 →

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 2 Feb 2024.

NVD record for CVE-2024-21893 →

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 8 Feb 2024.

NVD record for CVE-2023-35082 →

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 22 Jan 2024.

NVD record for CVE-2023-46805 →

Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 Nov 2023.

NVD record for CVE-2023-36851 →

Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 Nov 2023.

NVD record for CVE-2023-36847 →

Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 Nov 2023.

NVD record for CVE-2023-36846 →

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Nov 2023.

NVD record for CVE-2023-46747 →

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

CISA Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. Federal deadline 20 Oct 2023.

NVD record for CVE-2023-20198 →

JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 25 Oct 2023.

NVD record for CVE-2023-42793 →

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

CISA Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices. Federal deadline 4 Oct 2023.

NVD record for CVE-2023-20269 →

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Sep 2023.

NVD record for CVE-2023-27532 →

Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 6 Sep 2023.

NVD record for CVE-2023-24489 →

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Aug 2023.

NVD record for CVE-2023-35081 →

Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Aug 2023.

NVD record for CVE-2023-35078 →

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

CISA Apply updates per vendor instructions. Federal deadline 14 Jul 2023.

NVD record for CVE-2023-20867 →

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

CISA Apply updates per vendor instructions. Federal deadline 4 Jul 2023.

NVD record for CVE-2023-27997 →

Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.

CISA Apply updates per vendor instructions. Federal deadline 28 Apr 2023.

NVD record for CVE-2021-27878 →

Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

CISA Apply updates per vendor instructions. Federal deadline 28 Apr 2023.

NVD record for CVE-2021-27877 →

Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.

CISA Apply updates per vendor instructions. Federal deadline 28 Apr 2023.

NVD record for CVE-2021-27876 →

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

CISA Apply updates per vendor instructions. Federal deadline 3 Mar 2023.

NVD record for CVE-2022-24990 →

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

CISA Apply updates per vendor instructions. Federal deadline 23 Feb 2023.

NVD record for CVE-2022-21587 →

Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

CISA Apply updates per vendor instructions. Federal deadline 3 Jan 2023.

NVD record for CVE-2022-42475 →

Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

CISA Apply updates per vendor instructions. Federal deadline 3 Jan 2023.

NVD record for CVE-2022-27518 →

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CISA Apply updates per vendor instructions. Federal deadline 3 Jan 2023.

NVD record for CVE-2022-26501 →

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

CISA Apply updates per vendor instructions. Federal deadline 1 Nov 2022.

NVD record for CVE-2022-40684 →

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

CISA Apply updates per vendor instructions. Federal deadline 15 Sep 2022.

NVD record for CVE-2022-24112 →

Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.

CISA Apply updates per vendor instructions. Federal deadline 15 Sep 2022.

NVD record for CVE-2021-39226 →

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

CISA Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch]. Federal deadline 22 Jul 2022.

NVD record for CVE-2022-26925 →

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

CISA Apply updates per vendor instructions. Federal deadline 31 May 2022.

NVD record for CVE-2022-1388 →

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

CISA The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 21 Apr 2022.

NVD record for CVE-2018-10561 →

A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2022-26143 →

Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2021-22941 →

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2018-0147 →

A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2018-0125 →

A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2017-6316 →

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2017-3881 →

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

CISA The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 15 Apr 2022.

NVD record for CVE-2015-1187 →

A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

CISA Apply updates per vendor instructions. Federal deadline 5 Apr 2022.

NVD record for CVE-2019-0543 →

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2022-20708 →

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2022-20701 →

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2022-20700 →

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2022-20699 →

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2018-0158 →

A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2018-0151 →

The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.

CISA Apply updates per vendor instructions. Federal deadline 24 Mar 2022.

NVD record for CVE-2017-12240 →

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

CISA Apply updates per vendor instructions. Federal deadline 8 Mar 2022.

NVD record for CVE-2022-23131 →

Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

CISA Apply updates per vendor instructions. Federal deadline 1 Feb 2022.

NVD record for CVE-2021-33766 →

In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

CISA Apply updates per vendor instructions. Federal deadline 1 Feb 2022.

NVD record for CVE-2021-32648 →

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.

CISA Apply updates per vendor instructions. Federal deadline 18 Jul 2022.

NVD record for CVE-2020-13927 →

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

CISA Apply updates per vendor instructions. Federal deadline 10 Jul 2022.

NVD record for CVE-2018-13382 →

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

CISA Apply updates per vendor instructions. Federal deadline 15 Dec 2021.

NVD record for CVE-2021-44077 →

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

CISA Apply updates per vendor instructions. Federal deadline 15 Dec 2021.

NVD record for CVE-2021-37415 →

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-34523 →

Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2021-22893 →

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-20021 →

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-20016 →

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-8193 →

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-6287 →

SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-6207 →

Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-5849 →

VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-3952 →

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-3569 →

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-3566 →

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-12812 →

SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-10148 →

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-0688 →

ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-9082 →

SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-7481 →

Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-5591 →

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-19781 →

Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-13608 →

Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2019-11510 →

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2018-13379 →

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.

NVD record for CVE-2026-102489 →

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 1 Jun 2026.

NVD record for CVE-2026-0257 →

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

CISA Apply updates per vendor instructions. Federal deadline 4 Apr 2023.

NVD record for CVE-2023-23397 →

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 27 Sep 2026.

NVD record for CVE-2026-5430 →

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 21 Aug 2026.

NVD record for CVE-2026-55040 →

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

Privilege escalation in AD FS, and CISA's notes link Microsoft's decommission guide. The remediation they actually want is migration off it.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 28 Jul 2026.

NVD record for CVE-2026-56155 →

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

OIDC tokens accepted without signature verification, so a forged identity claim becomes a technician session, MFA included. Federation is only as strong as validation.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 2 Jul 2026.

NVD record for CVE-2026-48558 →

Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 2 Apr 2026.

NVD record for CVE-2026-3055 →

Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Dec 2025.

NVD record for CVE-2025-59718 →

Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2020-2021 →

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2022-20703 →

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-38648 →

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-38647 →

Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-1464 →

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.

NVD record for CVE-2026-102490 →

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 27 Sep 2026.

NVD record for CVE-2026-71362 →

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 14 Sep 2026.

NVD record for CVE-2026-84869 →

JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 25 Sep 2026.

NVD record for CVE-2026-42016 →

Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.

Reachable unauthenticated over HTTP and ends in takeover of Oracle Payments. Pre-auth plus money movement is as bad as this list gets.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 18 Jul 2026.

NVD record for CVE-2026-46817 →

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 29 May 2026.

NVD record for CVE-2026-48172 →

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 8 May 2026.

NVD record for CVE-2024-57726 →

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

CISA Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Federal deadline 27 Feb 2026.

NVD record for CVE-2022-20775 →

Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 3 Mar 2026.

NVD record for CVE-2026-21533 →

Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 11 Feb 2026.

NVD record for CVE-2026-20045 →

Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Jan 2026.

NVD record for CVE-2023-52163 →

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable Federal deadline 24 Dec 2025.

NVD record for CVE-2025-40602 →

Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 18 Nov 2025.

NVD record for CVE-2025-6205 →

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

CISA The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Federal deadline 26 Sep 2025.

NVD record for CVE-2025-20362 →

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 Sep 2025.

NVD record for CVE-2025-55177 →

Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 15 Sep 2025.

NVD record for CVE-2024-8068 →

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 24 Jun 2025.

NVD record for CVE-2025-21480 →

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 24 Jun 2025.

NVD record for CVE-2025-21479 →

Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 18 Mar 2025.

NVD record for CVE-2024-49035 →

Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 5 Mar 2025.

NVD record for CVE-2025-24200 →

Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Dec 2024.

NVD record for CVE-2024-21287 →

Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 1 Oct 2024.

NVD record for CVE-2024-38014 →

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 Sep 2024.

NVD record for CVE-2024-38856 →

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

CISA Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal deadline 4 Jul 2024.

NVD record for CVE-2024-26169 →

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

CISA This vulnerability affects legacy D-Link products. Federal deadline 6 Jun 2024.

NVD record for CVE-2021-40655 →

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 1 May 2024.

NVD record for CVE-2024-20359 →

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 28 Nov 2023.

NVD record for CVE-2023-22518 →

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

CISA Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. Federal deadline 27 Oct 2023.

NVD record for CVE-2023-20273 →

MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 10 Oct 2023.

NVD record for CVE-2023-28434 →

Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 12 Sep 2023.

NVD record for CVE-2023-38035 →

Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 2 Jun 2023.

NVD record for CVE-2021-3560 →

Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.

CISA Apply updates per vendor instructions. Federal deadline 28 Apr 2023.

NVD record for CVE-2019-1388 →

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

CISA Apply updates per vendor instructions. Federal deadline 4 Apr 2023.

NVD record for CVE-2023-24880 →

Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

CISA Apply updates per vendor instructions. Federal deadline 7 Mar 2023.

NVD record for CVE-2023-21715 →

Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

CISA Apply updates per vendor instructions. Federal deadline 9 Dec 2022.

NVD record for CVE-2022-41091 →

Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

CISA Apply updates per vendor instructions. Federal deadline 29 Nov 2022.

NVD record for CVE-2021-25337 →

The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 10 Nov 2022.

NVD record for CVE-2021-3493 →

An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.

CISA Apply updates per vendor instructions. Federal deadline 8 Sep 2022.

NVD record for CVE-2022-26923 →

Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CISA Apply updates per vendor instructions. Federal deadline 18 Jul 2022.

NVD record for CVE-2021-30533 →

QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.

CISA Apply updates per vendor instructions. Federal deadline 22 Jun 2022.

NVD record for CVE-2019-7192 →

The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.

CISA Apply updates per vendor instructions. Federal deadline 15 Jun 2022.

NVD record for CVE-2014-3153 →

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 2 May 2022.

NVD record for CVE-2021-42287 →

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 2 May 2022.

NVD record for CVE-2021-42278 →

Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 21 Apr 2022.

NVD record for CVE-2021-34484 →

Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

CISA Apply updates per vendor instructions. Federal deadline 18 Apr 2022.

NVD record for CVE-2022-0543 →

The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

CISA Apply updates per vendor instructions. Federal deadline 15 Apr 2022.

NVD record for CVE-2014-6324 →

Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

CISA Apply updates per vendor instructions. Federal deadline 17 Mar 2022.

NVD record for CVE-2018-0175 →

Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

CISA Apply updates per vendor instructions. Federal deadline 28 Jul 2022.

NVD record for CVE-2020-0787 →

Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

CISA Apply updates per vendor instructions. Federal deadline 10 Jun 2022.

NVD record for CVE-2019-13272 →

Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-37976 →

Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2021-34527 →

Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-30713 →

Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-30657 →

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-22986 →

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-20023 →

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-20022 →

EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-8655 →

VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-3950 →

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-1472 →

SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2016-3643 →

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

A hard-coded password in the console that manages your firewalls. No exploit chain required, just a login nobody could rotate or disable.

CISA Apply mitigations in accordance with vendor instructions. Federal deadline 1 Aug 2026.

NVD record for CVE-2026-20316 →

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 26 Mar 2026.

NVD record for CVE-2021-22681 →

Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 21 Feb 2026.

NVD record for CVE-2026-22769 →

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 5 Jan 2026.

NVD record for CVE-2025-14611 →

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

CISA Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 16 Jul 2025.

NVD record for CVE-2019-6693 →

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 13 Jan 2025.

NVD record for CVE-2021-44207 →

SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.

CISA Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 5 Nov 2024.

NVD record for CVE-2024-28987 →

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.

CISA This vulnerability affects legacy D-Link products. Federal deadline 2 May 2024.

NVD record for CVE-2024-3272 →

Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.

CISA Apply updates per vendor instructions. Federal deadline 28 Mar 2023.

NVD record for CVE-2022-28810 →

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

CISA Apply updates per vendor instructions. Federal deadline 19 Aug 2022.

NVD record for CVE-2022-26138 →

Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.

CISA Apply updates per vendor instructions. Federal deadline 17 Nov 2021.

NVD record for CVE-2021-30116 →

EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-8657 →

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2020-29583 →

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

CISA Apply updates per vendor instructions. Federal deadline 3 May 2022.

NVD record for CVE-2017-9248 →