https://cve.azmirilias.com/ CVEs from dbcve.org's CISA Known Exploited Vulnerabilities listing. en Wed, 04 Nov 2026 18:50:21 +0000 15 https://nvd.nist.gov/vuln/detail/CVE-2026-119977 WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. Vendor: WordPress Product: WordPress Core Added to CISA KEV: 2026-11-03 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-06 Known ransomware use: Unknown Tue, 03 Nov 2026 00:00:00 +0000 CVE-2026-119977 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-118527 Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. Vendor: Ivanti Product: Connect Secure Added to CISA KEV: 2026-10-30 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-13 Known ransomware use: Unknown Fri, 30 Oct 2026 00:00:00 +0000 CVE-2026-118527 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-111357 Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. Vendor: Ivanti Product: Connect Secure Added to CISA KEV: 2026-10-30 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-02 Known ransomware use: Unknown Fri, 30 Oct 2026 00:00:00 +0000 CVE-2026-111357 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-97229 GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. Vendor: GitLab Product: Community Edition and Enterprise Edition Added to CISA KEV: 2026-10-29 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-01 Known ransomware use: Unknown Thu, 29 Oct 2026 00:00:00 +0000 CVE-2026-97229 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Vendor: Cisco Product: Secure Firewall ASA Software and Cisco Secure FTD Software Added to CISA KEV: 2026-10-29 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-01 Known ransomware use: Unknown Thu, 29 Oct 2026 00:00:00 +0000 CVE-2026-76418 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-41709 Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Vendor: Broadcom Product: VMware ESX Added to CISA KEV: 2026-10-28 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-11 Known ransomware use: Unknown Wed, 28 Oct 2026 00:00:00 +0000 CVE-2026-41709 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-46300 Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-10-28 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-31 Known ransomware use: Unknown Wed, 28 Oct 2026 00:00:00 +0000 CVE-2026-46300 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48356 Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Vendor: Adobe Product: Commerce and Magento Added to CISA KEV: 2026-10-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-10 Known ransomware use: Unknown Tue, 27 Oct 2026 00:00:00 +0000 CVE-2026-48356 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-111497 Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Vendor: Google Product: Brotli Added to CISA KEV: 2026-10-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-10 Known ransomware use: Unknown Tue, 27 Oct 2026 00:00:00 +0000 CVE-2026-111497 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-109618 PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Vendor: PHP Group Product: PHP Added to CISA KEV: 2026-10-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-29 Known ransomware use: Unknown Mon, 26 Oct 2026 00:00:00 +0000 CVE-2026-109618 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-109619 PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Vendor: PHP Group Product: PHP Added to CISA KEV: 2026-10-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-29 Known ransomware use: Unknown Mon, 26 Oct 2026 00:00:00 +0000 CVE-2026-109619 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-114625 Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Vendor: Arista Product: VeloCloud Orchestrator Added to CISA KEV: 2026-10-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-26 Known ransomware use: Unknown Fri, 23 Oct 2026 00:00:00 +0000 CVE-2026-114625 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-110447 Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Vendor: Collabora Product: Collabora Online – Built-in CODE Server Added to CISA KEV: 2026-10-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-26 Known ransomware use: Unknown Fri, 23 Oct 2026 00:00:00 +0000 CVE-2026-110447 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Vendor: EG Secure Solutions Product: SiteGuard Server Edition Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-23 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-106931 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-96656 Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Vendor: Plex Product: Media Server Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-23 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-96656 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-96655 Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. Vendor: Plex Product: Media Server Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-03 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-96655 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-96654 Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. Vendor: Plex Product: Media Server Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-23 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-96654 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-96652 Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Vendor: Plex Product: Media Server Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-03 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-96652 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-110936 Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Vendor: Siemens Product: Software Center Added to CISA KEV: 2026-10-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-11-03 Known ransomware use: Unknown Tue, 20 Oct 2026 00:00:00 +0000 CVE-2026-110936 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-102764 BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Vendor: BeyondTrust Product: Remote Support Added to CISA KEV: 2026-10-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-19 Known ransomware use: Unknown Fri, 16 Oct 2026 00:00:00 +0000 CVE-2026-102764 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-61624 FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2026-10-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-19 Known ransomware use: Unknown Fri, 16 Oct 2026 00:00:00 +0000 CVE-2025-61624 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21589 Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Vendor: Atlassian Product: Multiple Products Added to CISA KEV: 2026-10-15 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-18 Known ransomware use: Unknown Thu, 15 Oct 2026 00:00:00 +0000 CVE-2026-21589 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-105134 Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Vendor: Ahsay Product: AhsayCBS Added to CISA KEV: 2026-10-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-17 Known ransomware use: Unknown Wed, 14 Oct 2026 00:00:00 +0000 CVE-2026-105134 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-76519 Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Vendor: Cisco Product: Secure Email Gateway Added to CISA KEV: 2026-10-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-17 Known ransomware use: Unknown Wed, 14 Oct 2026 00:00:00 +0000 CVE-2026-76519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-105133 Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Vendor: Ahsay Product: AhsayCBS Added to CISA KEV: 2026-10-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-17 Known ransomware use: Unknown Wed, 14 Oct 2026 00:00:00 +0000 CVE-2026-105133 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-0322 Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2026-10-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-17 Known ransomware use: Unknown Wed, 14 Oct 2026 00:00:00 +0000 CVE-2026-0322 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-104935 Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Vendor: Ivanti Product: Connect Secure Added to CISA KEV: 2026-10-13 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-16 Known ransomware use: Unknown Tue, 13 Oct 2026 00:00:00 +0000 CVE-2026-104935 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-96951 Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-10-13 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-16 Known ransomware use: Unknown Tue, 13 Oct 2026 00:00:00 +0000 CVE-2026-96951 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5477 ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Vendor: ISC Product: BIND Added to CISA KEV: 2026-10-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-11 Known ransomware use: Unknown Thu, 08 Oct 2026 00:00:00 +0000 CVE-2015-5477 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3081 Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Vendor: Apache Product: Struts Added to CISA KEV: 2026-10-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-11 Known ransomware use: Unknown Thu, 08 Oct 2026 00:00:00 +0000 CVE-2016-3081 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-22894 Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Vendor: Strapi Product: Strapi Added to CISA KEV: 2026-10-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-11 Known ransomware use: Unknown Thu, 08 Oct 2026 00:00:00 +0000 CVE-2023-22894 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-3199 ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Vendor: ONLYOFFICE Product: Docs Added to CISA KEV: 2026-10-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-11 Known ransomware use: Unknown Thu, 08 Oct 2026 00:00:00 +0000 CVE-2021-3199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-3306 ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Vendor: ProFTPD Product: ProFTPD Added to CISA KEV: 2026-10-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-11 Known ransomware use: Unknown Thu, 08 Oct 2026 00:00:00 +0000 CVE-2015-3306 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-88779 Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Vendor: Citrix Product: NetScaler Added to CISA KEV: 2026-10-04 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-07 Known ransomware use: Unknown Sun, 04 Oct 2026 00:00:00 +0000 CVE-2026-88779 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-102490 Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. Vendor: Zammad GmbH Product: Zammad Added to CISA KEV: 2026-10-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-05 Known ransomware use: Unknown Fri, 02 Oct 2026 00:00:00 +0000 CVE-2026-102490 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-102489 Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. Vendor: Zammad GmbH Product: Zammad Added to CISA KEV: 2026-10-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-05 Known ransomware use: Unknown Fri, 02 Oct 2026 00:00:00 +0000 CVE-2026-102489 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-104286 Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Vendor: Fortinet Product: FortiMail Added to CISA KEV: 2026-10-01 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-04 Known ransomware use: Unknown Thu, 01 Oct 2026 00:00:00 +0000 CVE-2026-104286 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-76504 Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Vendor: Cisco Product: Catalyst SD-WAN Manager Added to CISA KEV: 2026-09-30 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-03 Known ransomware use: Unknown Wed, 30 Sep 2026 00:00:00 +0000 CVE-2026-76504 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-86950 Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-09-29 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-10-13 Known ransomware use: Unknown Tue, 29 Sep 2026 00:00:00 +0000 CVE-2026-86950 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-88772 Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service Vendor: Citrix Product: NetScaler Added to CISA KEV: 2026-09-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-30 Known ransomware use: Unknown Sun, 27 Sep 2026 00:00:00 +0000 CVE-2026-88772 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-88771 Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. Vendor: Citrix Product: NetScaler Added to CISA KEV: 2026-09-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-30 Known ransomware use: Unknown Sun, 27 Sep 2026 00:00:00 +0000 CVE-2026-88771 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-67279 Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Vendor: MikroTik Product: RouterOS Added to CISA KEV: 2026-09-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-28 Known ransomware use: Unknown Fri, 25 Sep 2026 00:00:00 +0000 CVE-2026-67279 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-65660 Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2026-09-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-28 Known ransomware use: Unknown Fri, 25 Sep 2026 00:00:00 +0000 CVE-2026-65660 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-87902 WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Vendor: WordPress Product: Core Added to CISA KEV: 2026-09-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-28 Known ransomware use: Unknown Fri, 25 Sep 2026 00:00:00 +0000 CVE-2026-87902 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-5430 WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Vendor: WSO2 Product: Multiple Products Added to CISA KEV: 2026-09-24 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-27 Known ransomware use: Unknown Thu, 24 Sep 2026 00:00:00 +0000 CVE-2026-5430 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-71362 Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Vendor: Adobe Product: Commerce and Magento Added to CISA KEV: 2026-09-24 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-27 Known ransomware use: Unknown Thu, 24 Sep 2026 00:00:00 +0000 CVE-2026-71362 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-93952 Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Vendor: Arista Product: VeloCloud Orchestrator Added to CISA KEV: 2026-09-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Tue, 22 Sep 2026 00:00:00 +0000 CVE-2026-93952 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-94127 F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. Vendor: F5 Product: BIG-IP APM Added to CISA KEV: 2026-09-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Tue, 22 Sep 2026 00:00:00 +0000 CVE-2026-94127 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-93616 Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. Vendor: Check Point Product: Multiple Products Added to CISA KEV: 2026-09-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Tue, 22 Sep 2026 00:00:00 +0000 CVE-2026-93616 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-85102 Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. Vendor: Check Point Product: Multiple Products Added to CISA KEV: 2026-09-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Tue, 22 Sep 2026 00:00:00 +0000 CVE-2026-85102 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-7273 Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. Vendor: Zyxel Product: GS1900 Series Switches Added to CISA KEV: 2026-09-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-24 Known ransomware use: Unknown Mon, 21 Sep 2026 00:00:00 +0000 CVE-2026-7273 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-39964 Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-09-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-21 Known ransomware use: Unknown Fri, 18 Sep 2026 00:00:00 +0000 CVE-2025-39964 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-53266 Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-09-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-21 Known ransomware use: Unknown Fri, 18 Sep 2026 00:00:00 +0000 CVE-2026-53266 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-39682 Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-09-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-21 Known ransomware use: Unknown Fri, 18 Sep 2026 00:00:00 +0000 CVE-2025-39682 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-58704 Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Vendor: Google Product: Pixel Added to CISA KEV: 2026-09-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-19 Known ransomware use: Unknown Wed, 16 Sep 2026 00:00:00 +0000 CVE-2026-58704 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-76460 Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Vendor: Cisco Product: Identity Services Engine Added to CISA KEV: 2026-09-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-19 Known ransomware use: Unknown Wed, 16 Sep 2026 00:00:00 +0000 CVE-2026-76460 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-87886 Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. Vendor: Acronis Product: Backup Added to CISA KEV: 2026-09-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-19 Known ransomware use: Unknown Wed, 16 Sep 2026 00:00:00 +0000 CVE-2026-87886 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-76461 Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Vendor: Cisco Product: Secure Email Gateway Added to CISA KEV: 2026-09-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-17 Known ransomware use: Unknown Mon, 14 Sep 2026 00:00:00 +0000 CVE-2026-76461 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-84869 ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Vendor: ConnectWise Product: ScreenConnect Added to CISA KEV: 2026-09-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-14 Known ransomware use: Unknown Fri, 11 Sep 2026 00:00:00 +0000 CVE-2026-84869 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-42016 JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Vendor: JFrog Product: Artifactory Added to CISA KEV: 2026-09-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Fri, 11 Sep 2026 00:00:00 +0000 CVE-2026-42016 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-42018 JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. Vendor: JFrog Product: Artifactory Added to CISA KEV: 2026-09-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-25 Known ransomware use: Unknown Fri, 11 Sep 2026 00:00:00 +0000 CVE-2026-42018 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-85706 GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Vendor: GitLab Product: Community Edition and Enterprise Edition Added to CISA KEV: 2026-09-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-14 Known ransomware use: Unknown Fri, 11 Sep 2026 00:00:00 +0000 CVE-2026-85706 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-86060 MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. Vendor: MikroTik Product: RouterOS Added to CISA KEV: 2026-09-10 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-13 Known ransomware use: Unknown Thu, 10 Sep 2026 00:00:00 +0000 CVE-2026-86060 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-67277 MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. Vendor: MikroTik Product: RouterOS Added to CISA KEV: 2026-09-10 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-13 Known ransomware use: Unknown Thu, 10 Sep 2026 00:00:00 +0000 CVE-2026-67277 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-19490 Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Vendor: Citrix Product: NetScaler Added to CISA KEV: 2026-09-09 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-12 Known ransomware use: Unknown Wed, 09 Sep 2026 00:00:00 +0000 CVE-2026-19490 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-25249 Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2026-09-09 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-12 Known ransomware use: Unknown Wed, 09 Sep 2026 00:00:00 +0000 CVE-2025-25249 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-87491 Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2026-09-09 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-23 Known ransomware use: Unknown Wed, 09 Sep 2026 00:00:00 +0000 CVE-2026-87491 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20079 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Vendor: Cisco Product: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Added to CISA KEV: 2026-09-09 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-12 Known ransomware use: Unknown Wed, 09 Sep 2026 00:00:00 +0000 CVE-2026-20079 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-75650 Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Vendor: Adobe Product: Commerce and Magento Added to CISA KEV: 2026-09-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-11 Known ransomware use: Unknown Tue, 08 Sep 2026 00:00:00 +0000 CVE-2026-75650 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-81963 Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-09-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-22 Known ransomware use: Unknown Tue, 08 Sep 2026 00:00:00 +0000 CVE-2026-81963 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-86218 N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Vendor: N-able Product: N-central Added to CISA KEV: 2026-09-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-11 Known ransomware use: Unknown Tue, 08 Sep 2026 00:00:00 +0000 CVE-2026-86218 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-85880 Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-09-08 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-22 Known ransomware use: Unknown Tue, 08 Sep 2026 00:00:00 +0000 CVE-2026-85880 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-85046 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2026-09-04 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-18 Known ransomware use: Unknown Fri, 04 Sep 2026 00:00:00 +0000 CVE-2026-85046 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-59822 BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Vendor: BerriAI Product: LiteLLM Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-16 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-59822 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48710 Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. Vendor: Kludex Product: Starlette Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-16 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-48710 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-49869 Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Vendor: Kestra Product: Kestra OSS Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-05 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-49869 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-82329 JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Vendor: JFrog Product: Artifactory Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-05 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-82329 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-9586 Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Vendor: Sangoma Product: Switchvox Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-05 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-9586 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-83548 SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. Vendor: SonicWall Product: SMA1000 Appliances Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-05 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-83548 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-83549 SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. Vendor: SonicWall Product: SMA1000 Appliances Added to CISA KEV: 2026-09-02 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-05 Known ransomware use: Unknown Wed, 02 Sep 2026 00:00:00 +0000 CVE-2026-83549 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-82078 PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Vendor: PaperCut Product: NG/MF Added to CISA KEV: 2026-08-31 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-14 Known ransomware use: Unknown Mon, 31 Aug 2026 00:00:00 +0000 CVE-2026-82078 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-81578 PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. Vendor: PaperCut Product: NG/MF Added to CISA KEV: 2026-08-31 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-14 Known ransomware use: Unknown Mon, 31 Aug 2026 00:00:00 +0000 CVE-2026-81578 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-49105 ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. Vendor: ownCloud Product: ownCloud Added to CISA KEV: 2026-08-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-30 Known ransomware use: Unknown Thu, 27 Aug 2026 00:00:00 +0000 CVE-2023-49105 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-53362 Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-08-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-30 Known ransomware use: Unknown Thu, 27 Aug 2026 00:00:00 +0000 CVE-2026-53362 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-66384 JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Vendor: JFrog Product: Artifactory Added to CISA KEV: 2026-08-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-10 Known ransomware use: Unknown Thu, 27 Aug 2026 00:00:00 +0000 CVE-2026-66384 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-23758 Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Vendor: Ajax.NET Professional Product: Ajax.NET Professional Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-09 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2021-23758 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-3246 Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. Vendor: Red Hat Product: Libuser Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-09 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2015-3246 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5287 Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Vendor: Red Hat Product: Automatic Bug Reporting Tool Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-09 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2015-5287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0995 Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-29 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2022-0995 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. Vendor: Citrix Product: NetScaler ADC and NetScaler Gateway Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-29 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2026-8452 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1068 Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. Vendor: Microsoft Product: SQL Server Added to CISA KEV: 2026-08-26 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-29 Known ransomware use: Unknown Wed, 26 Aug 2026 00:00:00 +0000 CVE-2019-1068 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-60004 Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Vendor: Gitea Product: Gitea Added to CISA KEV: 2026-08-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-28 Known ransomware use: Unknown Tue, 25 Aug 2026 00:00:00 +0000 CVE-2026-60004 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Vendor: Oracle Product: HTTP Server and Oracle Weblogic Server Proxy Plug-in Added to CISA KEV: 2026-08-24 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-27 Known ransomware use: Unknown Mon, 24 Aug 2026 00:00:00 +0000 CVE-2026-21962 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-73570 Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2026-08-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-24 Known ransomware use: Unknown Fri, 21 Aug 2026 00:00:00 +0000 CVE-2026-73570 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-72530 TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. Vendor: TrueConf Product: Server Added to CISA KEV: 2026-08-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-03 Known ransomware use: Unknown Thu, 20 Aug 2026 00:00:00 +0000 CVE-2026-72530 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-72529 TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. Vendor: TrueConf Product: Server Added to CISA KEV: 2026-08-20 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-23 Known ransomware use: Unknown Thu, 20 Aug 2026 00:00:00 +0000 CVE-2026-72529 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-64849 MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Vendor: MLflow Product: MLflow Added to CISA KEV: 2026-08-19 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-09-02 Known ransomware use: Unknown Wed, 19 Aug 2026 00:00:00 +0000 CVE-2026-64849 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Vendor: Microsoft Product: Internet Key Exchange (IKE) Service Extensions Added to CISA KEV: 2026-08-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-21 Known ransomware use: Unknown Tue, 18 Aug 2026 00:00:00 +0000 CVE-2026-33824 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-59310 Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Vendor: Broadcom Product: VMware vCenter Added to CISA KEV: 2026-08-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-21 Known ransomware use: Known Tue, 18 Aug 2026 00:00:00 +0000 CVE-2026-59310 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-55040 Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2026-08-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-21 Known ransomware use: Unknown Tue, 18 Aug 2026 00:00:00 +0000 CVE-2026-55040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-65400 Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Vendor: Apple Product: macOS Added to CISA KEV: 2026-08-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-21 Known ransomware use: Unknown Tue, 18 Aug 2026 00:00:00 +0000 CVE-2026-65400 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-62593 Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Vendor: Ray-Project Product: Ray Added to CISA KEV: 2026-08-17 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-20 Known ransomware use: Unknown Mon, 17 Aug 2026 00:00:00 +0000 CVE-2025-62593 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Vendor: Cisco Product: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Added to CISA KEV: 2026-08-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-14 Known ransomware use: Unknown Tue, 11 Aug 2026 00:00:00 +0000 CVE-2026-20349 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Ancillary Function Driver for WinSock Added to CISA KEV: 2026-08-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-25 Known ransomware use: Unknown Tue, 11 Aug 2026 00:00:00 +0000 CVE-2026-68820 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-72898 Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Vendor: Metabase Product: Metabase Added to CISA KEV: 2026-08-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-14 Known ransomware use: Unknown Tue, 11 Aug 2026 00:00:00 +0000 CVE-2026-72898 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-8037 Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Vendor: Progress Product: LoadMaster Added to CISA KEV: 2026-08-07 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-10 Known ransomware use: Unknown Fri, 07 Aug 2026 00:00:00 +0000 CVE-2026-8037 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-63077 JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Vendor: JetBrains Product: TeamCity Added to CISA KEV: 2026-08-05 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-08 Known ransomware use: Known Wed, 05 Aug 2026 00:00:00 +0000 CVE-2026-63077 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-18556 N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass. Vendor: N-able Product: N-central Added to CISA KEV: 2026-08-04 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-07 Known ransomware use: Unknown Tue, 04 Aug 2026 00:00:00 +0000 CVE-2026-18556 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34486 Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Vendor: Apache Product: Tomcat Added to CISA KEV: 2026-08-04 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-07 Known ransomware use: Unknown Tue, 04 Aug 2026 00:00:00 +0000 CVE-2026-34486 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-9198 Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Vendor: IBM Product: Langflow Added to CISA KEV: 2026-08-04 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-07 Known ransomware use: Unknown Tue, 04 Aug 2026 00:00:00 +0000 CVE-2026-9198 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-18577 N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. Vendor: N-able Product: N-central Added to CISA KEV: 2026-08-03 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-06 Known ransomware use: Unknown Mon, 03 Aug 2026 00:00:00 +0000 CVE-2026-18577 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Vendor: Cisco Product: Secure Firewall Management Center (FMC) Added to CISA KEV: 2026-07-29 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-01 Known ransomware use: Known Wed, 29 Jul 2026 00:00:00 +0000 CVE-2026-20316 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-68686 Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2026-07-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-10 Known ransomware use: Unknown Mon, 27 Jul 2026 00:00:00 +0000 CVE-2025-68686 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Vendor: Arista Product: VeloCloud Orchestrator Added to CISA KEV: 2026-07-27 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-30 Known ransomware use: Unknown Mon, 27 Jul 2026 00:00:00 +0000 CVE-2026-16812 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-16232 Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Vendor: Check Point Product: SmartConsole Added to CISA KEV: 2026-07-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-25 Known ransomware use: Unknown Wed, 22 Jul 2026 00:00:00 +0000 CVE-2026-16232 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-50522 Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2026-07-22 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-25 Known ransomware use: Unknown Wed, 22 Jul 2026 00:00:00 +0000 CVE-2026-50522 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-60137 WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Vendor: WordPress Product: Core Added to CISA KEV: 2026-07-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-08-04 Known ransomware use: Unknown Tue, 21 Jul 2026 00:00:00 +0000 CVE-2026-60137 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-63030 WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. Vendor: WordPress Product: Core Added to CISA KEV: 2026-07-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-24 Known ransomware use: Unknown Tue, 21 Jul 2026 00:00:00 +0000 CVE-2026-63030 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-0770 Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Vendor: Langflow Product: Langflow Added to CISA KEV: 2026-07-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-24 Known ransomware use: Unknown Tue, 21 Jul 2026 00:00:00 +0000 CVE-2026-0770 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27137 DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. Vendor: DD-WRT Product: DD-WRT Added to CISA KEV: 2026-07-21 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-24 Known ransomware use: Unknown Tue, 21 Jul 2026 00:00:00 +0000 CVE-2021-27137 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-58644 Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2026-07-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-19 Known ransomware use: Unknown Thu, 16 Jul 2026 00:00:00 +0000 CVE-2026-58644 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-25089 Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Vendor: Fortinet Product: FortiSandbox Added to CISA KEV: 2026-07-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-19 Known ransomware use: Unknown Thu, 16 Jul 2026 00:00:00 +0000 CVE-2026-25089 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-39808 Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. Vendor: Fortinet Product: FortiSandbox Added to CISA KEV: 2026-07-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-19 Known ransomware use: Unknown Thu, 16 Jul 2026 00:00:00 +0000 CVE-2026-39808 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-46817 Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Vendor: Oracle Product: E-Business Suite Added to CISA KEV: 2026-07-15 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-18 Known ransomware use: Unknown Wed, 15 Jul 2026 00:00:00 +0000 CVE-2026-46817 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. Vendor: KNX Association Product: KNX Protocol Connection Authorization Option 1 Added to CISA KEV: 2026-07-15 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-29 Known ransomware use: Unknown Wed, 15 Jul 2026 00:00:00 +0000 CVE-2023-4346 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-56155 Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Active Directory Federation Services Added to CISA KEV: 2026-07-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-28 Known ransomware use: Unknown Tue, 14 Jul 2026 00:00:00 +0000 CVE-2026-56155 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-56164 Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Vendor: Microsoft Product: SharePoint Server Added to CISA KEV: 2026-07-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-17 Known ransomware use: Unknown Tue, 14 Jul 2026 00:00:00 +0000 CVE-2026-56164 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-15409 SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. Vendor: SonicWall Product: SMA1000 Appliances Added to CISA KEV: 2026-07-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-17 Known ransomware use: Known Tue, 14 Jul 2026 00:00:00 +0000 CVE-2026-15409 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-15410 SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. Vendor: SonicWall Product: SMA1000 Appliances Added to CISA KEV: 2026-07-14 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-17 Known ransomware use: Known Tue, 14 Jul 2026 00:00:00 +0000 CVE-2026-15410 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-4128 Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. Vendor: Cisco Product: IOS Added to CISA KEV: 2026-07-13 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-16 Known ransomware use: Unknown Mon, 13 Jul 2026 00:00:00 +0000 CVE-2008-4128 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-56291 Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE. Vendor: Balbooa Product: Forms Added to CISA KEV: 2026-07-10 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-13 Known ransomware use: Unknown Fri, 10 Jul 2026 00:00:00 +0000 CVE-2026-56291 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48939 iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. Vendor: iCagenda Product: iCagenda Added to CISA KEV: 2026-07-10 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-13 Known ransomware use: Unknown Fri, 10 Jul 2026 00:00:00 +0000 CVE-2026-48939 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48908 JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. Vendor: JoomShaper Product: SP Page Builder Added to CISA KEV: 2026-07-07 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-10 Known ransomware use: Unknown Tue, 07 Jul 2026 00:00:00 +0000 CVE-2026-48908 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-55255 Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Vendor: Langflow Product: Langflow Added to CISA KEV: 2026-07-07 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-10 Known ransomware use: Unknown Tue, 07 Jul 2026 00:00:00 +0000 CVE-2026-55255 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-56290 Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Vendor: Joomlack Product: Page Builder Added to CISA KEV: 2026-07-07 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-10 Known ransomware use: Unknown Tue, 07 Jul 2026 00:00:00 +0000 CVE-2026-56290 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48282 Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2026-07-07 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-10 Known ransomware use: Unknown Tue, 07 Jul 2026 00:00:00 +0000 CVE-2026-48282 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-45659 Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Vendor: Microsoft Product: SharePoint Server Added to CISA KEV: 2026-07-01 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-04 Known ransomware use: Known Wed, 01 Jul 2026 00:00:00 +0000 CVE-2026-45659 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48558 SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. Vendor: SimpleHelp Product: SimpleHelp Added to CISA KEV: 2026-06-29 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-07-02 Known ransomware use: Unknown Mon, 29 Jun 2026 00:00:00 +0000 CVE-2026-48558 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-12569 PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. Vendor: PTC Product: Windchill and FlexPLM Added to CISA KEV: 2026-06-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-28 Known ransomware use: Known Thu, 25 Jun 2026 00:00:00 +0000 CVE-2026-12569 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20230 Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. Vendor: Cisco Product: Unified Communications Manager Added to CISA KEV: 2026-06-25 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-28 Known ransomware use: Unknown Thu, 25 Jun 2026 00:00:00 +0000 CVE-2026-20230 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-67038 Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. Vendor: Lantronix Product: EDS5000 Added to CISA KEV: 2026-06-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-26 Known ransomware use: Unknown Tue, 23 Jun 2026 00:00:00 +0000 CVE-2025-67038 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34910 Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection. Vendor: Ubiquiti Product: UniFi OS Added to CISA KEV: 2026-06-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-26 Known ransomware use: Unknown Tue, 23 Jun 2026 00:00:00 +0000 CVE-2026-34910 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34909 Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account. Vendor: Ubiquiti Product: UniFi OS Added to CISA KEV: 2026-06-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-26 Known ransomware use: Unknown Tue, 23 Jun 2026 00:00:00 +0000 CVE-2026-34909 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34908 Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system. Vendor: Ubiquiti Product: UniFi OS Added to CISA KEV: 2026-06-23 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-26 Known ransomware use: Unknown Tue, 23 Jun 2026 00:00:00 +0000 CVE-2026-34908 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20253 Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. Vendor: Splunk Product: Enterprise Added to CISA KEV: 2026-06-18 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-21 Known ransomware use: Unknown Thu, 18 Jun 2026 00:00:00 +0000 CVE-2026-20253 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48907 Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Vendor: Widget Factory Product: Joomla Content Editor Added to CISA KEV: 2026-06-16 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-19 Known ransomware use: Unknown Tue, 16 Jun 2026 00:00:00 +0000 CVE-2026-48907 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-54420 LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. Vendor: LiteSpeed Product: cPanel Plugin Added to CISA KEV: 2026-06-15 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-18 Known ransomware use: Unknown Mon, 15 Jun 2026 00:00:00 +0000 CVE-2026-54420 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20262 Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Vendor: Cisco Product: Catalyst SD-WAN Manager Added to CISA KEV: 2026-06-15 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-29 Known ransomware use: Unknown Mon, 15 Jun 2026 00:00:00 +0000 CVE-2026-20262 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Vendor: Oracle Product: PeopleSoft Enterprise PeopleTools Added to CISA KEV: 2026-06-12 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-15 Known ransomware use: Known Fri, 12 Jun 2026 00:00:00 +0000 CVE-2026-35273 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-10520 Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Vendor: Ivanti Product: Sentry Added to CISA KEV: 2026-06-11 CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date: 2026-06-14 Known ransomware use: Unknown Thu, 11 Jun 2026 00:00:00 +0000 CVE-2026-10520 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-11645 Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2026-06-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-23 Known ransomware use: Unknown Tue, 09 Jun 2026 00:00:00 +0000 CVE-2026-11645 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-7473 Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. Vendor: Arista Product: Extensible Operating System Added to CISA KEV: 2026-06-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-23 Known ransomware use: Unknown Tue, 09 Jun 2026 00:00:00 +0000 CVE-2026-7473 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20245 Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Vendor: Cisco Product: Catalyst SD-WAN Manager Added to CISA KEV: 2026-06-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-23 Known ransomware use: Unknown Tue, 09 Jun 2026 00:00:00 +0000 CVE-2026-20245 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-42271 BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. Vendor: BerriAI Product: LiteLLM Added to CISA KEV: 2026-06-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-22 Known ransomware use: Unknown Mon, 08 Jun 2026 00:00:00 +0000 CVE-2026-42271 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-50751 Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Vendor: Check Point Product: Security Gateway Added to CISA KEV: 2026-06-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-11 Known ransomware use: Known Mon, 08 Jun 2026 00:00:00 +0000 CVE-2026-50751 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-28318 SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. Vendor: SolarWinds Product: Serv-U Added to CISA KEV: 2026-06-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-19 Known ransomware use: Unknown Fri, 05 Jun 2026 00:00:00 +0000 CVE-2026-28318 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-45247 Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Vendor: Mirasvit Product: Mirasvit Full Page Cache Warmer Added to CISA KEV: 2026-06-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-06 Known ransomware use: Unknown Wed, 03 Jun 2026 00:00:00 +0000 CVE-2026-45247 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0492 Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-05 Known ransomware use: Unknown Tue, 02 Jun 2026 00:00:00 +0000 CVE-2022-0492 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48595 Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. Vendor: Android Product: Framework Added to CISA KEV: 2026-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-05 Known ransomware use: Unknown Tue, 02 Jun 2026 00:00:00 +0000 CVE-2025-48595 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21182 Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2026-06-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-04 Known ransomware use: Unknown Mon, 01 Jun 2026 00:00:00 +0000 CVE-2024-21182 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-0257 Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2026-05-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-01 Known ransomware use: Known Fri, 29 May 2026 00:00:00 +0000 CVE-2026-0257 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48027 Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Vendor: Nx Product: Nx Console Added to CISA KEV: 2026-05-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-10 Known ransomware use: Known Wed, 27 May 2026 00:00:00 +0000 CVE-2026-48027 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-45321 TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Vendor: TanStack Product: TanStack Added to CISA KEV: 2026-05-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-10 Known ransomware use: Known Wed, 27 May 2026 00:00:00 +0000 CVE-2026-45321 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-8398 Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability. Vendor: Daemon Product: Daemon Tools Lite Added to CISA KEV: 2026-05-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-30 Known ransomware use: Unknown Wed, 27 May 2026 00:00:00 +0000 CVE-2026-8398 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-48172 LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. Vendor: LiteSpeed Product: cPanel Plugin Added to CISA KEV: 2026-05-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-29 Known ransomware use: Unknown Tue, 26 May 2026 00:00:00 +0000 CVE-2026-48172 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-9082 Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Vendor: Drupal Product: Core Added to CISA KEV: 2026-05-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-27 Known ransomware use: Unknown Fri, 22 May 2026 00:00:00 +0000 CVE-2026-9082 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-34291 Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Vendor: Langflow Product: Langflow Added to CISA KEV: 2026-05-21 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-04 Known ransomware use: Unknown Thu, 21 May 2026 00:00:00 +0000 CVE-2025-34291 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34926 Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. Vendor: Trend Micro Product: Apex One Added to CISA KEV: 2026-05-21 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-04 Known ransomware use: Unknown Thu, 21 May 2026 00:00:00 +0000 CVE-2026-34926 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-4250 Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2008-4250 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-1537 Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. Vendor: Microsoft Product: DirectX Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2009-1537 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-3459 Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2009-3459 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0249 Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2010-0249 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0806 Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2010-0806 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-41091 Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Defender Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2026-41091 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-45498 Microsoft Defender contains an unspecified vulnerability that allows for denial of service. Vendor: Microsoft Product: Defender Added to CISA KEV: 2026-05-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-06-03 Known ransomware use: Unknown Wed, 20 May 2026 00:00:00 +0000 CVE-2026-45498 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-42897 Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Vendor: Microsoft Product: Microsoft Added to CISA KEV: 2026-05-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-29 Known ransomware use: Unknown Fri, 15 May 2026 00:00:00 +0000 CVE-2026-42897 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20182 Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Vendor: Cisco Product: Catalyst SD-WAN Added to CISA KEV: 2026-05-14 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-05-17 Known ransomware use: Unknown Thu, 14 May 2026 00:00:00 +0000 CVE-2026-20182 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-42208 BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Vendor: BerriAI Product: LiteLLM Added to CISA KEV: 2026-05-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-11 Known ransomware use: Unknown Fri, 08 May 2026 00:00:00 +0000 CVE-2026-42208 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2026-05-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-10 Known ransomware use: Unknown Thu, 07 May 2026 00:00:00 +0000 CVE-2026-6973 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-0300 Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2026-05-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch. Federal due date: 2026-05-09 Known ransomware use: Unknown Wed, 06 May 2026 00:00:00 +0000 CVE-2026-0300 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-31431 Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-05-01 CISA required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-15 Known ransomware use: Unknown Fri, 01 May 2026 00:00:00 +0000 CVE-2026-31431 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-41940 WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Vendor: WebPros Product: cPanel & WHM and WP2 (WordPress Squared) Added to CISA KEV: 2026-04-30 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-03 Known ransomware use: Known Thu, 30 Apr 2026 00:00:00 +0000 CVE-2026-41940 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-1708 ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems. Vendor: ConnectWise Product: ScreenConnect Added to CISA KEV: 2026-04-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-12 Known ransomware use: Known Tue, 28 Apr 2026 00:00:00 +0000 CVE-2024-1708 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-32202 Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-04-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-12 Known ransomware use: Unknown Tue, 28 Apr 2026 00:00:00 +0000 CVE-2026-32202 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-29635 D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: D-Link Product: DIR-823X Added to CISA KEV: 2026-04-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-08 Known ransomware use: Unknown Fri, 24 Apr 2026 00:00:00 +0000 CVE-2025-29635 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7399 Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority. Vendor: Samsung Product: MagicINFO 9 Server Added to CISA KEV: 2026-04-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-08 Known ransomware use: Unknown Fri, 24 Apr 2026 00:00:00 +0000 CVE-2024-7399 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-57728 SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. Vendor: SimpleHelp Product: SimpleHelp Added to CISA KEV: 2026-04-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-08 Known ransomware use: Known Fri, 24 Apr 2026 00:00:00 +0000 CVE-2024-57728 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-57726 SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. Vendor: SimpleHelp Product: SimpleHelp Added to CISA KEV: 2026-04-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-08 Known ransomware use: Known Fri, 24 Apr 2026 00:00:00 +0000 CVE-2024-57726 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-39987 Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands. Vendor: Marimo Product: Marimo Added to CISA KEV: 2026-04-23 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-07 Known ransomware use: Unknown Thu, 23 Apr 2026 00:00:00 +0000 CVE-2026-39987 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-33825 Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Vendor: Microsoft Product: Defender Added to CISA KEV: 2026-04-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-06 Known ransomware use: Known Wed, 22 Apr 2026 00:00:00 +0000 CVE-2026-33825 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20122 Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Vendor: Cisco Product: Catalyst SD-WAN Manger Added to CISA KEV: 2026-04-20 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-04-23 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2026-20122 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20133 Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. Vendor: Cisco Product: Catalyst SD-WAN Manager Added to CISA KEV: 2026-04-20 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-04-23 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2026-20133 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2749 Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations. Vendor: Kentico Product: Kentico Xperience Added to CISA KEV: 2026-04-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-04 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2025-2749 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27351 PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class. Vendor: PaperCut Product: NG/MF Added to CISA KEV: 2026-04-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-04 Known ransomware use: Known Mon, 20 Apr 2026 00:00:00 +0000 CVE-2023-27351 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2026-04-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-23 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2025-48700 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20128 Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user. Vendor: Cisco Product: Catalyst SD-WAN Manager Added to CISA KEV: 2026-04-20 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-04-23 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2026-20128 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials. Vendor: Quest Product: KACE Systems Management Appliance (SMA) Added to CISA KEV: 2026-04-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-04 Known ransomware use: Unknown Mon, 20 Apr 2026 00:00:00 +0000 CVE-2025-32975 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-27199 JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. Vendor: JetBrains Product: TeamCity Added to CISA KEV: 2026-04-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-05-04 Known ransomware use: Known Mon, 20 Apr 2026 00:00:00 +0000 CVE-2024-27199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34197 Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Vendor: Apache Product: ActiveMQ Added to CISA KEV: 2026-04-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-30 Known ransomware use: Unknown Thu, 16 Apr 2026 00:00:00 +0000 CVE-2026-34197 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-0238 Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. Vendor: Microsoft Product: Office Added to CISA KEV: 2026-04-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-28 Known ransomware use: Unknown Tue, 14 Apr 2026 00:00:00 +0000 CVE-2009-0238 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-32201 Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Vendor: Microsoft Product: SharePoint Server Added to CISA KEV: 2026-04-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-28 Known ransomware use: Unknown Tue, 14 Apr 2026 00:00:00 +0000 CVE-2026-32201 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1854 Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution. Vendor: Microsoft Product: Visual Basic for Applications (VBA) Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Unknown Mon, 13 Apr 2026 00:00:00 +0000 CVE-2012-1854 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-60710 Microsoft Windows contains a link following vulnerability that allows for privilege escalation Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Known Mon, 13 Apr 2026 00:00:00 +0000 CVE-2025-60710 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21529 Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Known Mon, 13 Apr 2026 00:00:00 +0000 CVE-2023-21529 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36424 Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Unknown Mon, 13 Apr 2026 00:00:00 +0000 CVE-2023-36424 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9715 Adobe Acrobat contains a use-after-free vulnerability that allows for code execution Vendor: Adobe Product: Acrobat Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Unknown Mon, 13 Apr 2026 00:00:00 +0000 CVE-2020-9715 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21643 Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Vendor: Fortinet Product: FortiClient EMS Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-16 Known ransomware use: Unknown Mon, 13 Apr 2026 00:00:00 +0000 CVE-2026-21643 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-34621 Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2026-04-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-27 Known ransomware use: Unknown Mon, 13 Apr 2026 00:00:00 +0000 CVE-2026-34621 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2026-04-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-11 Known ransomware use: Unknown Wed, 08 Apr 2026 00:00:00 +0000 CVE-2026-1340 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-35616 Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Vendor: Fortinet Product: FortiClient EMS Added to CISA KEV: 2026-04-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-09 Known ransomware use: Unknown Mon, 06 Apr 2026 00:00:00 +0000 CVE-2026-35616 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-3502 TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user. Vendor: TrueConf Product: Client Added to CISA KEV: 2026-04-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-16 Known ransomware use: Unknown Thu, 02 Apr 2026 00:00:00 +0000 CVE-2026-3502 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-5281 Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Dawn Added to CISA KEV: 2026-04-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-15 Known ransomware use: Unknown Wed, 01 Apr 2026 00:00:00 +0000 CVE-2026-5281 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-3055 Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. Vendor: Citrix Product: NetScaler Added to CISA KEV: 2026-03-30 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-02 Known ransomware use: Unknown Mon, 30 Mar 2026 00:00:00 +0000 CVE-2026-3055 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-53521 F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. Vendor: F5 Product: BIG-IP Added to CISA KEV: 2026-03-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-30 Known ransomware use: Unknown Fri, 27 Mar 2026 00:00:00 +0000 CVE-2025-53521 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-33634 Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory. Vendor: Aquasecurity Product: Trivy Added to CISA KEV: 2026-03-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-09 Known ransomware use: Unknown Thu, 26 Mar 2026 00:00:00 +0000 CVE-2026-33634 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-33017 Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Vendor: Langflow Product: Langflow Added to CISA KEV: 2026-03-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-08 Known ransomware use: Unknown Wed, 25 Mar 2026 00:00:00 +0000 CVE-2026-33017 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32432 Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. Vendor: Craft CMS Product: Craft CMS Added to CISA KEV: 2026-03-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-03 Known ransomware use: Unknown Fri, 20 Mar 2026 00:00:00 +0000 CVE-2025-32432 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54068 Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. Vendor: Laravel Product: Livewire Added to CISA KEV: 2026-03-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-03 Known ransomware use: Unknown Fri, 20 Mar 2026 00:00:00 +0000 CVE-2025-54068 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-43510 Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-03-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-03 Known ransomware use: Unknown Fri, 20 Mar 2026 00:00:00 +0000 CVE-2025-43510 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-43520 Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-03-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-03 Known ransomware use: Unknown Fri, 20 Mar 2026 00:00:00 +0000 CVE-2025-43520 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31277 Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-03-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-03 Known ransomware use: Unknown Fri, 20 Mar 2026 00:00:00 +0000 CVE-2025-31277 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Vendor: Cisco Product: Secure Firewall Management Center (FMC) Added to CISA KEV: 2026-03-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-22 Known ransomware use: Known Thu, 19 Mar 2026 00:00:00 +0000 CVE-2026-20131 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2026-03-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-04-01 Known ransomware use: Unknown Wed, 18 Mar 2026 00:00:00 +0000 CVE-2025-66376 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20963 Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2026-03-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-21 Known ransomware use: Unknown Wed, 18 Mar 2026 00:00:00 +0000 CVE-2026-20963 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-47813 Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie. Vendor: Wing FTP Server Product: Wing FTP Server Added to CISA KEV: 2026-03-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-30 Known ransomware use: Unknown Mon, 16 Mar 2026 00:00:00 +0000 CVE-2025-47813 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-3910 Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2026-03-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-27 Known ransomware use: Unknown Fri, 13 Mar 2026 00:00:00 +0000 CVE-2026-3910 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-3909 Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Vendor: Google Product: Skia Added to CISA KEV: 2026-03-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-27 Known ransomware use: Unknown Fri, 13 Mar 2026 00:00:00 +0000 CVE-2026-3909 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-68613 n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution. Vendor: n8n Product: n8n Added to CISA KEV: 2026-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-25 Known ransomware use: Unknown Wed, 11 Mar 2026 00:00:00 +0000 CVE-2025-68613 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22054 Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. Vendor: Omnissa Product: Workspace One UEM Added to CISA KEV: 2026-03-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-23 Known ransomware use: Unknown Mon, 09 Mar 2026 00:00:00 +0000 CVE-2021-22054 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-26399 SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Vendor: SolarWinds Product: Web Help Desk Added to CISA KEV: 2026-03-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-12 Known ransomware use: Known Mon, 09 Mar 2026 00:00:00 +0000 CVE-2025-26399 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-1603 Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Vendor: Ivanti Product: Endpoint Manager (EPM) Added to CISA KEV: 2026-03-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-23 Known ransomware use: Unknown Mon, 09 Mar 2026 00:00:00 +0000 CVE-2026-1603 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-7921 Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information. Vendor: Hikvision Product: Multiple Products Added to CISA KEV: 2026-03-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-26 Known ransomware use: Unknown Thu, 05 Mar 2026 00:00:00 +0000 CVE-2017-7921 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22681 Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller. Vendor: Rockwell Product: Multiple Products Added to CISA KEV: 2026-03-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-26 Known ransomware use: Unknown Thu, 05 Mar 2026 00:00:00 +0000 CVE-2021-22681 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-43000 Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-03-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-26 Known ransomware use: Unknown Thu, 05 Mar 2026 00:00:00 +0000 CVE-2023-43000 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30952 Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-03-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-26 Known ransomware use: Unknown Thu, 05 Mar 2026 00:00:00 +0000 CVE-2021-30952 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41974 Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. Vendor: Apple Product: iOS and iPadOS Added to CISA KEV: 2026-03-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-26 Known ransomware use: Unknown Thu, 05 Mar 2026 00:00:00 +0000 CVE-2023-41974 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-22719 Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Vendor: Broadcom Product: VMware Aria Operations Added to CISA KEV: 2026-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-24 Known ransomware use: Unknown Tue, 03 Mar 2026 00:00:00 +0000 CVE-2026-22719 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21385 Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2026-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-24 Known ransomware use: Unknown Tue, 03 Mar 2026 00:00:00 +0000 CVE-2026-21385 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20775 Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Vendor: Cisco Product: SD-WAN Added to CISA KEV: 2026-02-25 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-02-27 Known ransomware use: Unknown Wed, 25 Feb 2026 00:00:00 +0000 CVE-2022-20775 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20127 Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. Vendor: Cisco Product: Catalyst SD-WAN Controller and Manager Added to CISA KEV: 2026-02-25 CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2026-02-27 Known ransomware use: Unknown Wed, 25 Feb 2026 00:00:00 +0000 CVE-2026-20127 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-25108 Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request. Vendor: Soliton Systems K.K Product: FileZen Added to CISA KEV: 2026-02-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-17 Known ransomware use: Unknown Tue, 24 Feb 2026 00:00:00 +0000 CVE-2026-25108 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-49113 RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2026-02-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-13 Known ransomware use: Unknown Fri, 20 Feb 2026 00:00:00 +0000 CVE-2025-49113 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-68461 RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2026-02-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-13 Known ransomware use: Unknown Fri, 20 Feb 2026 00:00:00 +0000 CVE-2025-68461 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22175 GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. Vendor: GitLab Product: GitLab Added to CISA KEV: 2026-02-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-11 Known ransomware use: Unknown Wed, 18 Feb 2026 00:00:00 +0000 CVE-2021-22175 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-22769 Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence. Vendor: Dell Product: RecoverPoint for Virtual Machines (RP4VMs) Added to CISA KEV: 2026-02-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-21 Known ransomware use: Unknown Wed, 18 Feb 2026 00:00:00 +0000 CVE-2026-22769 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled. Vendor: Synacor Product: Zimbra Collaboration Suite Added to CISA KEV: 2026-02-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-10 Known ransomware use: Unknown Tue, 17 Feb 2026 00:00:00 +0000 CVE-2020-7796 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7694 TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server. Vendor: TeamT5 Product: ThreatSonar Anti-Ransomware Added to CISA KEV: 2026-02-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-10 Known ransomware use: Unknown Tue, 17 Feb 2026 00:00:00 +0000 CVE-2024-7694 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-0015 Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-10 Known ransomware use: Unknown Tue, 17 Feb 2026 00:00:00 +0000 CVE-2008-0015 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-2441 Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2026-02-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-10 Known ransomware use: Unknown Tue, 17 Feb 2026 00:00:00 +0000 CVE-2026-2441 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Vendor: BeyondTrust Product: Remote Support (RS) and Privileged Remote Access (PRA) Added to CISA KEV: 2026-02-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Known Fri, 13 Feb 2026 00:00:00 +0000 CVE-2026-1731 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20700 Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2026-02-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-05 Known ransomware use: Unknown Thu, 12 Feb 2026 00:00:00 +0000 CVE-2026-20700 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43468 Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database. Vendor: Microsoft Product: Configuration Manager Added to CISA KEV: 2026-02-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-05 Known ransomware use: Unknown Thu, 12 Feb 2026 00:00:00 +0000 CVE-2024-43468 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-15556 Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user. Vendor: Notepad++ Product: Notepad++ Added to CISA KEV: 2026-02-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-05 Known ransomware use: Unknown Thu, 12 Feb 2026 00:00:00 +0000 CVE-2025-15556 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-40536 SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. Vendor: SolarWinds Product: Web Help Desk Added to CISA KEV: 2026-02-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-15 Known ransomware use: Unknown Thu, 12 Feb 2026 00:00:00 +0000 CVE-2025-40536 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21513 Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21513 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21525 Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21525 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21510 Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21510 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21533 Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21533 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21519 Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21514 Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Office Added to CISA KEV: 2026-02-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-03-03 Known ransomware use: Unknown Tue, 10 Feb 2026 00:00:00 +0000 CVE-2026-21514 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-11953 React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Vendor: React Native Community Product: CLI Added to CISA KEV: 2026-02-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-26 Known ransomware use: Unknown Thu, 05 Feb 2026 00:00:00 +0000 CVE-2025-11953 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-24423 SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Vendor: SmarterTools Product: SmarterMail Added to CISA KEV: 2026-02-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-26 Known ransomware use: Known Thu, 05 Feb 2026 00:00:00 +0000 CVE-2026-24423 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-39935 GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Vendor: GitLab Product: Community and Enterprise Editions Added to CISA KEV: 2026-02-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-24 Known ransomware use: Unknown Tue, 03 Feb 2026 00:00:00 +0000 CVE-2021-39935 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-64328 Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Vendor: Sangoma Product: FreePBX Added to CISA KEV: 2026-02-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-24 Known ransomware use: Unknown Tue, 03 Feb 2026 00:00:00 +0000 CVE-2025-64328 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-19006 Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin. Vendor: Sangoma Product: FreePBX Added to CISA KEV: 2026-02-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-24 Known ransomware use: Unknown Tue, 03 Feb 2026 00:00:00 +0000 CVE-2019-19006 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-40551 SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Vendor: SolarWinds Product: Web Help Desk Added to CISA KEV: 2026-02-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-06 Known ransomware use: Unknown Tue, 03 Feb 2026 00:00:00 +0000 CVE-2025-40551 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2026-01-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-01 Known ransomware use: Unknown Thu, 29 Jan 2026 00:00:00 +0000 CVE-2026-1281 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-24858 Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2026-01-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-30 Known ransomware use: Unknown Tue, 27 Jan 2026 00:00:00 +0000 CVE-2026-24858 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14634 Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system. Vendor: Linux Product: Kernel Added to CISA KEV: 2026-01-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Unknown Mon, 26 Jan 2026 00:00:00 +0000 CVE-2018-14634 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-52691 SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Vendor: SmarterTools Product: SmarterMail Added to CISA KEV: 2026-01-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Known Mon, 26 Jan 2026 00:00:00 +0000 CVE-2025-52691 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-23760 SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. Vendor: SmarterTools Product: SmarterMail Added to CISA KEV: 2026-01-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Known Mon, 26 Jan 2026 00:00:00 +0000 CVE-2026-23760 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-24061 GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable. Vendor: GNU Product: InetUtils Added to CISA KEV: 2026-01-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Unknown Mon, 26 Jan 2026 00:00:00 +0000 CVE-2026-24061 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-21509 Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Vendor: Microsoft Product: Office Added to CISA KEV: 2026-01-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-16 Known ransomware use: Unknown Mon, 26 Jan 2026 00:00:00 +0000 CVE-2026-21509 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-37079 Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution. Vendor: Broadcom Product: VMware vCenter Server Added to CISA KEV: 2026-01-23 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-13 Known ransomware use: Unknown Fri, 23 Jan 2026 00:00:00 +0000 CVE-2024-37079 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2026-01-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-12 Known ransomware use: Unknown Thu, 22 Jan 2026 00:00:00 +0000 CVE-2025-68645 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-34026 Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs. Vendor: Versa Product: Concerto Added to CISA KEV: 2026-01-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-12 Known ransomware use: Unknown Thu, 22 Jan 2026 00:00:00 +0000 CVE-2025-34026 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31125 Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Vendor: Vite Product: Vitejs Added to CISA KEV: 2026-01-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-12 Known ransomware use: Unknown Thu, 22 Jan 2026 00:00:00 +0000 CVE-2025-31125 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54313 Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. Vendor: Prettier Product: eslint-config-prettier Added to CISA KEV: 2026-01-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-12 Known ransomware use: Unknown Thu, 22 Jan 2026 00:00:00 +0000 CVE-2025-54313 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20045 Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Vendor: Cisco Product: Unified Communications Manager Added to CISA KEV: 2026-01-21 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-11 Known ransomware use: Unknown Wed, 21 Jan 2026 00:00:00 +0000 CVE-2026-20045 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2026-20805 Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2026-01-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-03 Known ransomware use: Unknown Tue, 13 Jan 2026 00:00:00 +0000 CVE-2026-20805 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-8110 Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution. Vendor: Gogs Product: Gogs Added to CISA KEV: 2026-01-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-02-02 Known ransomware use: Unknown Mon, 12 Jan 2026 00:00:00 +0000 CVE-2025-8110 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-0556 Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption. Vendor: Microsoft Product: Office Added to CISA KEV: 2026-01-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-28 Known ransomware use: Unknown Wed, 07 Jan 2026 00:00:00 +0000 CVE-2009-0556 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution. Vendor: Hewlett Packard Enterprise (HPE) Product: OneView Added to CISA KEV: 2026-01-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-28 Known ransomware use: Unknown Wed, 07 Jan 2026 00:00:00 +0000 CVE-2025-37164 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-14847 MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client. Vendor: MongoDB Product: MongoDB and MongoDB Server Added to CISA KEV: 2025-12-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-19 Known ransomware use: Unknown Mon, 29 Dec 2025 00:00:00 +0000 CVE-2025-14847 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-52163 Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. Vendor: Digiever Product: DS-2105 Pro Added to CISA KEV: 2025-12-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-12 Known ransomware use: Unknown Mon, 22 Dec 2025 00:00:00 +0000 CVE-2023-52163 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-14733 WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. Vendor: WatchGuard Product: Firebox Added to CISA KEV: 2025-12-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-26 Known ransomware use: Known Fri, 19 Dec 2025 00:00:00 +0000 CVE-2025-14733 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-59374 ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: ASUS Product: Live Update Added to CISA KEV: 2025-12-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-07 Known ransomware use: Unknown Wed, 17 Dec 2025 00:00:00 +0000 CVE-2025-59374 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-40602 SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. Vendor: SonicWall Product: SMA1000 appliance Added to CISA KEV: 2025-12-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable Federal due date: 2025-12-24 Known ransomware use: Unknown Wed, 17 Dec 2025 00:00:00 +0000 CVE-2025-40602 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20393 Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Vendor: Cisco Product: Multiple Products Added to CISA KEV: 2025-12-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-24 Known ransomware use: Unknown Wed, 17 Dec 2025 00:00:00 +0000 CVE-2025-20393 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-59718 Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2025-12-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-23 Known ransomware use: Unknown Tue, 16 Dec 2025 00:00:00 +0000 CVE-2025-59718 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-14611 Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. Vendor: Gladinet Product: CentreStack and Triofox Added to CISA KEV: 2025-12-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-05 Known ransomware use: Unknown Mon, 15 Dec 2025 00:00:00 +0000 CVE-2025-14611 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-43529 Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-12-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-05 Known ransomware use: Unknown Mon, 15 Dec 2025 00:00:00 +0000 CVE-2025-43529 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-4063 Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Sierra Wireless Product: AirLink ALEOS Added to CISA KEV: 2025-12-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-02 Known ransomware use: Unknown Fri, 12 Dec 2025 00:00:00 +0000 CVE-2018-4063 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-14174 Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2025-12-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-02 Known ransomware use: Unknown Fri, 12 Dec 2025 00:00:00 +0000 CVE-2025-14174 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-58360 OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Vendor: OSGeo Product: GeoServer Added to CISA KEV: 2025-12-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2026-01-01 Known ransomware use: Unknown Thu, 11 Dec 2025 00:00:00 +0000 CVE-2025-58360 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6218 RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. Vendor: RARLAB Product: WinRAR Added to CISA KEV: 2025-12-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-30 Known ransomware use: Unknown Tue, 09 Dec 2025 00:00:00 +0000 CVE-2025-6218 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-62221 Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-12-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-30 Known ransomware use: Unknown Tue, 09 Dec 2025 00:00:00 +0000 CVE-2025-62221 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-37055 D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: D-Link Product: Routers Added to CISA KEV: 2025-12-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-29 Known ransomware use: Unknown Mon, 08 Dec 2025 00:00:00 +0000 CVE-2022-37055 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-66644 Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. Vendor: Array Networks Product: ArrayOS AG Added to CISA KEV: 2025-12-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-29 Known ransomware use: Unknown Mon, 08 Dec 2025 00:00:00 +0000 CVE-2025-66644 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-55182 Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. Vendor: Meta Product: React Server Components Added to CISA KEV: 2025-12-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-12 Known ransomware use: Known Fri, 05 Dec 2025 00:00:00 +0000 CVE-2025-55182 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26828 OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Vendor: OpenPLC Product: ScadaBR Added to CISA KEV: 2025-12-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-24 Known ransomware use: Unknown Wed, 03 Dec 2025 00:00:00 +0000 CVE-2021-26828 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48633 Android Framework contains an unspecified vulnerability that allows for information disclosure. Vendor: Android Product: Framework Added to CISA KEV: 2025-12-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-23 Known ransomware use: Unknown Tue, 02 Dec 2025 00:00:00 +0000 CVE-2025-48633 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48572 Android Framework contains an unspecified vulnerability that allows for privilege escalation. Vendor: Android Product: Framework Added to CISA KEV: 2025-12-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-23 Known ransomware use: Unknown Tue, 02 Dec 2025 00:00:00 +0000 CVE-2025-48572 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26829 OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. Vendor: OpenPLC Product: ScadaBR Added to CISA KEV: 2025-11-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-19 Known ransomware use: Unknown Fri, 28 Nov 2025 00:00:00 +0000 CVE-2021-26829 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-61757 Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2025-11-21 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-12 Known ransomware use: Unknown Fri, 21 Nov 2025 00:00:00 +0000 CVE-2025-61757 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-13223 Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2025-11-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-10 Known ransomware use: Unknown Wed, 19 Nov 2025 00:00:00 +0000 CVE-2025-13223 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-58034 Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Vendor: Fortinet Product: FortiWeb Added to CISA KEV: 2025-11-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-25 Known ransomware use: Unknown Tue, 18 Nov 2025 00:00:00 +0000 CVE-2025-58034 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-64446 Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. Vendor: Fortinet Product: FortiWeb Added to CISA KEV: 2025-11-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-21 Known ransomware use: Unknown Fri, 14 Nov 2025 00:00:00 +0000 CVE-2025-64446 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-12480 Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. Vendor: Gladinet Product: Triofox Added to CISA KEV: 2025-11-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-03 Known ransomware use: Unknown Wed, 12 Nov 2025 00:00:00 +0000 CVE-2025-12480 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-62215 Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-11-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-03 Known ransomware use: Unknown Wed, 12 Nov 2025 00:00:00 +0000 CVE-2025-62215 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-9242 WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code. Vendor: WatchGuard Product: Firebox Added to CISA KEV: 2025-11-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-03 Known ransomware use: Unknown Wed, 12 Nov 2025 00:00:00 +0000 CVE-2025-9242 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21042 Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2025-11-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-12-01 Known ransomware use: Unknown Mon, 10 Nov 2025 00:00:00 +0000 CVE-2025-21042 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48703 CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Vendor: CWP Product: Control Web Panel Added to CISA KEV: 2025-11-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-25 Known ransomware use: Unknown Tue, 04 Nov 2025 00:00:00 +0000 CVE-2025-48703 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-11371 Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. Vendor: Gladinet Product: CentreStack and Triofox Added to CISA KEV: 2025-11-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-25 Known ransomware use: Unknown Tue, 04 Nov 2025 00:00:00 +0000 CVE-2025-11371 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Vendor: Broadcom Product: VMware Aria Operations and VMware Tools Added to CISA KEV: 2025-10-30 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-20 Known ransomware use: Unknown Thu, 30 Oct 2025 00:00:00 +0000 CVE-2025-41244 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24893 XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. Vendor: XWiki Product: Platform Added to CISA KEV: 2025-10-30 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-20 Known ransomware use: Unknown Thu, 30 Oct 2025 00:00:00 +0000 CVE-2025-24893 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6204 Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. Vendor: Dassault Systèmes Product: DELMIA Apriso Added to CISA KEV: 2025-10-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-18 Known ransomware use: Unknown Tue, 28 Oct 2025 00:00:00 +0000 CVE-2025-6204 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6205 Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. Vendor: Dassault Systèmes Product: DELMIA Apriso Added to CISA KEV: 2025-10-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-18 Known ransomware use: Unknown Tue, 28 Oct 2025 00:00:00 +0000 CVE-2025-6205 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54236 Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. Vendor: Adobe Product: Commerce and Magento Added to CISA KEV: 2025-10-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-14 Known ransomware use: Unknown Fri, 24 Oct 2025 00:00:00 +0000 CVE-2025-54236 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-59287 Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-24 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-14 Known ransomware use: Unknown Fri, 24 Oct 2025 00:00:00 +0000 CVE-2025-59287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-61932 Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets. Vendor: Motex Product: LANSCOPE Endpoint Manager Added to CISA KEV: 2025-10-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-12 Known ransomware use: Unknown Wed, 22 Oct 2025 00:00:00 +0000 CVE-2025-61932 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-48503 Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-10-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-10 Known ransomware use: Unknown Mon, 20 Oct 2025 00:00:00 +0000 CVE-2022-48503 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2746 Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. Vendor: Kentico Product: Xperience CMS Added to CISA KEV: 2025-10-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-10 Known ransomware use: Unknown Mon, 20 Oct 2025 00:00:00 +0000 CVE-2025-2746 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2747 Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. Vendor: Kentico Product: Xperience CMS Added to CISA KEV: 2025-10-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-10 Known ransomware use: Unknown Mon, 20 Oct 2025 00:00:00 +0000 CVE-2025-2747 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-33073 Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-10 Known ransomware use: Unknown Mon, 20 Oct 2025 00:00:00 +0000 CVE-2025-33073 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-61884 Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Vendor: Oracle Product: E-Business Suite Added to CISA KEV: 2025-10-20 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-10 Known ransomware use: Known Mon, 20 Oct 2025 00:00:00 +0000 CVE-2025-61884 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54253 Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. Vendor: Adobe Product: Experience Manager (AEM) Forms Added to CISA KEV: 2025-10-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-05 Known ransomware use: Unknown Wed, 15 Oct 2025 00:00:00 +0000 CVE-2025-54253 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-47827 IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. Vendor: IGEL Product: IGEL OS Added to CISA KEV: 2025-10-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-04 Known ransomware use: Unknown Tue, 14 Oct 2025 00:00:00 +0000 CVE-2025-47827 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24990 Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-04 Known ransomware use: Unknown Tue, 14 Oct 2025 00:00:00 +0000 CVE-2025-24990 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-59230 Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-04 Known ransomware use: Unknown Tue, 14 Oct 2025 00:00:00 +0000 CVE-2025-59230 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7836 SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Vendor: SKYSEA Product: Client View Added to CISA KEV: 2025-10-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-11-04 Known ransomware use: Unknown Tue, 14 Oct 2025 00:00:00 +0000 CVE-2016-7836 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-43798 Grafana contains a path traversal vulnerability that could allow access to local files. Vendor: Grafana Labs Product: Grafana Added to CISA KEV: 2025-10-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-30 Known ransomware use: Unknown Thu, 09 Oct 2025 00:00:00 +0000 CVE-2021-43798 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-27915 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2025-10-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-28 Known ransomware use: Unknown Tue, 07 Oct 2025 00:00:00 +0000 CVE-2025-27915 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22555 Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Unknown Mon, 06 Oct 2025 00:00:00 +0000 CVE-2021-22555 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-3962 Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Unknown Mon, 06 Oct 2025 00:00:00 +0000 CVE-2010-3962 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-43226 Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Known Mon, 06 Oct 2025 00:00:00 +0000 CVE-2021-43226 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3918 Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Unknown Mon, 06 Oct 2025 00:00:00 +0000 CVE-2013-3918 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-3402 Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Unknown Mon, 06 Oct 2025 00:00:00 +0000 CVE-2011-3402 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-3765 Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption. Vendor: Mozilla Product: Multiple Products Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Unknown Mon, 06 Oct 2025 00:00:00 +0000 CVE-2010-3765 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-61882 Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing. Vendor: Oracle Product: E-Business Suite Added to CISA KEV: 2025-10-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-27 Known ransomware use: Known Mon, 06 Oct 2025 00:00:00 +0000 CVE-2025-61882 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6278 GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. Vendor: GNU Product: GNU Bash Added to CISA KEV: 2025-10-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-23 Known ransomware use: Unknown Thu, 02 Oct 2025 00:00:00 +0000 CVE-2014-6278 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-1000353 Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. Vendor: Jenkins Product: Jenkins Added to CISA KEV: 2025-10-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-23 Known ransomware use: Unknown Thu, 02 Oct 2025 00:00:00 +0000 CVE-2017-1000353 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-7755 Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device. Vendor: Juniper Product: ScreenOS Added to CISA KEV: 2025-10-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-23 Known ransomware use: Unknown Thu, 02 Oct 2025 00:00:00 +0000 CVE-2015-7755 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21043 Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2025-10-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-23 Known ransomware use: Unknown Thu, 02 Oct 2025 00:00:00 +0000 CVE-2025-21043 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-4008 Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices. Vendor: Smartbedded Product: Meteobridge Added to CISA KEV: 2025-10-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-23 Known ransomware use: Unknown Thu, 02 Oct 2025 00:00:00 +0000 CVE-2025-4008 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32463 Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Vendor: Sudo Product: Sudo Added to CISA KEV: 2025-09-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-20 Known ransomware use: Unknown Mon, 29 Sep 2025 00:00:00 +0000 CVE-2025-32463 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-59689 Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment. Vendor: Libraesva Product: Email Security Gateway Added to CISA KEV: 2025-09-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-20 Known ransomware use: Unknown Mon, 29 Sep 2025 00:00:00 +0000 CVE-2025-59689 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-10035 Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Vendor: Fortra Product: GoAnywhere MFT Added to CISA KEV: 2025-09-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-20 Known ransomware use: Known Mon, 29 Sep 2025 00:00:00 +0000 CVE-2025-10035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20352 Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Vendor: Cisco Product: IOS and IOS XE Added to CISA KEV: 2025-09-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-20 Known ransomware use: Unknown Mon, 29 Sep 2025 00:00:00 +0000 CVE-2025-20352 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21311 Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. Vendor: Adminer Product: Adminer Added to CISA KEV: 2025-09-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-20 Known ransomware use: Unknown Mon, 29 Sep 2025 00:00:00 +0000 CVE-2021-21311 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20362 Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. Vendor: Cisco Product: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Added to CISA KEV: 2025-09-25 CISA required action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2025-09-26 Known ransomware use: Unknown Thu, 25 Sep 2025 00:00:00 +0000 CVE-2025-20362 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20333 Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. Vendor: Cisco Product: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Added to CISA KEV: 2025-09-25 CISA required action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2025-09-26 Known ransomware use: Unknown Thu, 25 Sep 2025 00:00:00 +0000 CVE-2025-20333 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-10585 Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2025-09-23 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-14 Known ransomware use: Unknown Tue, 23 Sep 2025 00:00:00 +0000 CVE-2025-10585 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-5086 Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution. Vendor: Dassault Systèmes Product: DELMIA Apriso Added to CISA KEV: 2025-09-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-10-02 Known ransomware use: Unknown Thu, 11 Sep 2025 00:00:00 +0000 CVE-2025-5086 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-38352 Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-09-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-25 Known ransomware use: Unknown Thu, 04 Sep 2025 00:00:00 +0000 CVE-2025-38352 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48543 Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation. Vendor: Android Product: Runtime Added to CISA KEV: 2025-09-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-25 Known ransomware use: Unknown Thu, 04 Sep 2025 00:00:00 +0000 CVE-2025-48543 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-53690 Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Vendor: Sitecore Product: Multiple Products Added to CISA KEV: 2025-09-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-25 Known ransomware use: Unknown Thu, 04 Sep 2025 00:00:00 +0000 CVE-2025-53690 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-50224 TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: TP-Link Product: TL-WR841N Added to CISA KEV: 2025-09-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-24 Known ransomware use: Unknown Wed, 03 Sep 2025 00:00:00 +0000 CVE-2023-50224 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-9377 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: TP-Link Product: Multiple Routers Added to CISA KEV: 2025-09-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-24 Known ransomware use: Unknown Wed, 03 Sep 2025 00:00:00 +0000 CVE-2025-9377 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-24363 TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: TP-Link Product: TL-WA855RE Added to CISA KEV: 2025-09-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-23 Known ransomware use: Unknown Tue, 02 Sep 2025 00:00:00 +0000 CVE-2020-24363 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-55177 Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. Vendor: Meta Platforms Product: WhatsApp Added to CISA KEV: 2025-09-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-23 Known ransomware use: Unknown Tue, 02 Sep 2025 00:00:00 +0000 CVE-2025-55177 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-57819 Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Vendor: Sangoma Product: FreePBX Added to CISA KEV: 2025-08-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-19 Known ransomware use: Unknown Fri, 29 Aug 2025 00:00:00 +0000 CVE-2025-57819 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-7775 Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. Vendor: Citrix Product: NetScaler Added to CISA KEV: 2025-08-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-28 Known ransomware use: Unknown Tue, 26 Aug 2025 00:00:00 +0000 CVE-2025-7775 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files. Vendor: Git Product: Git Added to CISA KEV: 2025-08-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-15 Known ransomware use: Unknown Mon, 25 Aug 2025 00:00:00 +0000 CVE-2025-48384 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8068 Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain. Vendor: Citrix Product: Session Recording Added to CISA KEV: 2025-08-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-15 Known ransomware use: Unknown Mon, 25 Aug 2025 00:00:00 +0000 CVE-2024-8068 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8069 Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server. Vendor: Citrix Product: Session Recording Added to CISA KEV: 2025-08-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-15 Known ransomware use: Unknown Mon, 25 Aug 2025 00:00:00 +0000 CVE-2024-8069 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-43300 Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2025-08-21 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-11 Known ransomware use: Unknown Thu, 21 Aug 2025 00:00:00 +0000 CVE-2025-43300 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54948 Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. Vendor: Trend Micro Product: Apex One Added to CISA KEV: 2025-08-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-08 Known ransomware use: Unknown Mon, 18 Aug 2025 00:00:00 +0000 CVE-2025-54948 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-8876 N-able N-Central contains a command injection vulnerability via improper sanitization of user input. Vendor: N-able Product: N-Central Added to CISA KEV: 2025-08-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-20 Known ransomware use: Unknown Wed, 13 Aug 2025 00:00:00 +0000 CVE-2025-8876 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-8875 N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution. Vendor: N-able Product: N-Central Added to CISA KEV: 2025-08-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-20 Known ransomware use: Unknown Wed, 13 Aug 2025 00:00:00 +0000 CVE-2025-8875 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-8088 RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Vendor: RARLAB Product: WinRAR Added to CISA KEV: 2025-08-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-02 Known ransomware use: Known Tue, 12 Aug 2025 00:00:00 +0000 CVE-2025-8088 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2007-0671 Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system. Vendor: Microsoft Product: Office Added to CISA KEV: 2025-08-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-02 Known ransomware use: Unknown Tue, 12 Aug 2025 00:00:00 +0000 CVE-2007-0671 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3893 Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2025-08-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-09-02 Known ransomware use: Unknown Tue, 12 Aug 2025 00:00:00 +0000 CVE-2013-3893 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-25078 D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: D-Link Product: DCS-2530L and DCS-2670L Devices Added to CISA KEV: 2025-08-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-26 Known ransomware use: Unknown Tue, 05 Aug 2025 00:00:00 +0000 CVE-2020-25078 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-25079 D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: D-Link Product: DCS-2530L and DCS-2670L Devices Added to CISA KEV: 2025-08-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-26 Known ransomware use: Unknown Tue, 05 Aug 2025 00:00:00 +0000 CVE-2020-25079 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-40799 D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: D-Link Product: DNR-322L Added to CISA KEV: 2025-08-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-26 Known ransomware use: Unknown Tue, 05 Aug 2025 00:00:00 +0000 CVE-2022-40799 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-2533 PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. Vendor: PaperCut Product: NG/MF Added to CISA KEV: 2025-07-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-18 Known ransomware use: Unknown Mon, 28 Jul 2025 00:00:00 +0000 CVE-2023-2533 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20337 Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Vendor: Cisco Product: Identity Services Engine Added to CISA KEV: 2025-07-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-18 Known ransomware use: Unknown Mon, 28 Jul 2025 00:00:00 +0000 CVE-2025-20337 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-20281 Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Vendor: Cisco Product: Identity Services Engine Added to CISA KEV: 2025-07-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-18 Known ransomware use: Unknown Mon, 28 Jul 2025 00:00:00 +0000 CVE-2025-20281 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2775 SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. Vendor: SysAid Product: SysAid On-Prem Added to CISA KEV: 2025-07-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-12 Known ransomware use: Unknown Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-2775 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2776 SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. Vendor: SysAid Product: SysAid On-Prem Added to CISA KEV: 2025-07-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-12 Known ransomware use: Unknown Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-2776 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6558 Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2025-07-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-12 Known ransomware use: Unknown Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-6558 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-54309 CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS. Vendor: CrushFTP Product: CrushFTP Added to CISA KEV: 2025-07-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-12 Known ransomware use: Unknown Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-54309 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-49704 Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2025-07-22 CISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2025-07-23 Known ransomware use: Known Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-49704 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-49706 Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2025-07-22 CISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2025-07-23 Known ransomware use: Known Tue, 22 Jul 2025 00:00:00 +0000 CVE-2025-49706 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-53770 Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2025-07-20 CISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal due date: 2025-07-21 Known ransomware use: Known Sun, 20 Jul 2025 00:00:00 +0000 CVE-2025-53770 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-25257 Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Vendor: Fortinet Product: FortiWeb Added to CISA KEV: 2025-07-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-08 Known ransomware use: Unknown Fri, 18 Jul 2025 00:00:00 +0000 CVE-2025-25257 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-47812 Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). Vendor: Wing FTP Server Product: Wing FTP Server Added to CISA KEV: 2025-07-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-08-04 Known ransomware use: Unknown Mon, 14 Jul 2025 00:00:00 +0000 CVE-2025-47812 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-5777 Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Vendor: Citrix Product: NetScaler ADC and Gateway Added to CISA KEV: 2025-07-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-11 Known ransomware use: Known Thu, 10 Jul 2025 00:00:00 +0000 CVE-2025-5777 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2025-07-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-28 Known ransomware use: Unknown Mon, 07 Jul 2025 00:00:00 +0000 CVE-2019-9621 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-5418 Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. Vendor: Rails Product: Ruby on Rails Added to CISA KEV: 2025-07-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-28 Known ransomware use: Unknown Mon, 07 Jul 2025 00:00:00 +0000 CVE-2019-5418 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-10033 PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Vendor: PHP Product: PHPMailer Added to CISA KEV: 2025-07-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-28 Known ransomware use: Unknown Mon, 07 Jul 2025 00:00:00 +0000 CVE-2016-10033 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-3931 Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption. Vendor: Looking Glass Product: Multi-Router Looking Glass (MRLG) Added to CISA KEV: 2025-07-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-28 Known ransomware use: Unknown Mon, 07 Jul 2025 00:00:00 +0000 CVE-2014-3931 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6554 Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2025-07-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-23 Known ransomware use: Unknown Wed, 02 Jul 2025 00:00:00 +0000 CVE-2025-6554 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48928 TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump. Vendor: TeleMessage Product: TM SGNL Added to CISA KEV: 2025-07-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-22 Known ransomware use: Unknown Tue, 01 Jul 2025 00:00:00 +0000 CVE-2025-48928 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-48927 TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI. Vendor: TeleMessage Product: TM SGNL Added to CISA KEV: 2025-07-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-22 Known ransomware use: Unknown Tue, 01 Jul 2025 00:00:00 +0000 CVE-2025-48927 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-6543 Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Vendor: Citrix Product: NetScaler ADC and Gateway Added to CISA KEV: 2025-06-30 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-21 Known ransomware use: Unknown Mon, 30 Jun 2025 00:00:00 +0000 CVE-2025-6543 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-6693 Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2025-06-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-16 Known ransomware use: Known Wed, 25 Jun 2025 00:00:00 +0000 CVE-2019-6693 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-0769 D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Vendor: D-Link Product: DIR-859 Router Added to CISA KEV: 2025-06-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-16 Known ransomware use: Unknown Wed, 25 Jun 2025 00:00:00 +0000 CVE-2024-0769 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-54085 AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Vendor: AMI Product: MegaRAC SPx Added to CISA KEV: 2025-06-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-16 Known ransomware use: Unknown Wed, 25 Jun 2025 00:00:00 +0000 CVE-2024-54085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-0386 Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-06-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-08 Known ransomware use: Unknown Tue, 17 Jun 2025 00:00:00 +0000 CVE-2023-0386 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33538 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: TP-Link Product: Multiple Routers Added to CISA KEV: 2025-06-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-07 Known ransomware use: Unknown Mon, 16 Jun 2025 00:00:00 +0000 CVE-2023-33538 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-43200 Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-06-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-07 Known ransomware use: Unknown Mon, 16 Jun 2025 00:00:00 +0000 CVE-2025-43200 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-33053 Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-06-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-01 Known ransomware use: Unknown Tue, 10 Jun 2025 00:00:00 +0000 CVE-2025-33053 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24016 Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers. Vendor: Wazuh Product: Wazuh Server Added to CISA KEV: 2025-06-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-07-01 Known ransomware use: Unknown Tue, 10 Jun 2025 00:00:00 +0000 CVE-2025-24016 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-42009 RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2025-06-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-30 Known ransomware use: Unknown Mon, 09 Jun 2025 00:00:00 +0000 CVE-2024-42009 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32433 Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE. Vendor: Erlang Product: Erlang/OTP Added to CISA KEV: 2025-06-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-30 Known ransomware use: Unknown Mon, 09 Jun 2025 00:00:00 +0000 CVE-2025-32433 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-5419 Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2025-06-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-26 Known ransomware use: Unknown Thu, 05 Jun 2025 00:00:00 +0000 CVE-2025-5419 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21479 Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2025-06-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-24 Known ransomware use: Unknown Tue, 03 Jun 2025 00:00:00 +0000 CVE-2025-21479 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21480 Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2025-06-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-24 Known ransomware use: Unknown Tue, 03 Jun 2025 00:00:00 +0000 CVE-2025-21480 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-27038 Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2025-06-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-24 Known ransomware use: Unknown Tue, 03 Jun 2025 00:00:00 +0000 CVE-2025-27038 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-32030 ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: ASUS Product: Routers Added to CISA KEV: 2025-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-23 Known ransomware use: Unknown Mon, 02 Jun 2025 00:00:00 +0000 CVE-2021-32030 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-3935 ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Vendor: ConnectWise Product: ScreenConnect Added to CISA KEV: 2025-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-23 Known ransomware use: Unknown Mon, 02 Jun 2025 00:00:00 +0000 CVE-2025-3935 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-35939 Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. Vendor: Craft CMS Product: Craft CMS Added to CISA KEV: 2025-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-23 Known ransomware use: Unknown Mon, 02 Jun 2025 00:00:00 +0000 CVE-2025-35939 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-56145 Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. Vendor: Craft CMS Product: Craft CMS Added to CISA KEV: 2025-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-23 Known ransomware use: Unknown Mon, 02 Jun 2025 00:00:00 +0000 CVE-2024-56145 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-39780 ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346. Vendor: ASUS Product: RT-AX55 Routers Added to CISA KEV: 2025-06-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-23 Known ransomware use: Unknown Mon, 02 Jun 2025 00:00:00 +0000 CVE-2023-39780 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-4632 Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority. Vendor: Samsung Product: MagicINFO 9 Server Added to CISA KEV: 2025-05-22 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-12 Known ransomware use: Unknown Thu, 22 May 2025 00:00:00 +0000 CVE-2025-4632 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38950 ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload. Vendor: ZKTeco Product: BioTime Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2023-38950 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-27443 Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2024-27443 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-27920 Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. Vendor: Srimax Product: Output Messenger Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2025-27920 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-11182 MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message. Vendor: MDaemon Product: Email Server Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2024-11182 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2025-4428 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-4427 Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2025-05-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-09 Known ransomware use: Unknown Mon, 19 May 2025 00:00:00 +0000 CVE-2025-4427 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-42999 SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2025-05-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-05 Known ransomware use: Known Thu, 15 May 2025 00:00:00 +0000 CVE-2025-42999 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-12987 DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. Vendor: DrayTek Product: Vigor Routers Added to CISA KEV: 2025-05-15 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-05 Known ransomware use: Unknown Thu, 15 May 2025 00:00:00 +0000 CVE-2024-12987 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32756 Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2025-05-14 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-04 Known ransomware use: Unknown Wed, 14 May 2025 00:00:00 +0000 CVE-2025-32756 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32709 Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-05-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-03 Known ransomware use: Unknown Tue, 13 May 2025 00:00:00 +0000 CVE-2025-32709 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-30397 Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-05-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-03 Known ransomware use: Unknown Tue, 13 May 2025 00:00:00 +0000 CVE-2025-30397 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32706 Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-05-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-03 Known ransomware use: Unknown Tue, 13 May 2025 00:00:00 +0000 CVE-2025-32706 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-32701 Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-05-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-03 Known ransomware use: Unknown Tue, 13 May 2025 00:00:00 +0000 CVE-2025-32701 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-30400 Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-05-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-03 Known ransomware use: Unknown Tue, 13 May 2025 00:00:00 +0000 CVE-2025-30400 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-47729 TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users. Vendor: TeleMessage Product: TM SGNL Added to CISA KEV: 2025-05-12 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-06-02 Known ransomware use: Unknown Mon, 12 May 2025 00:00:00 +0000 CVE-2025-47729 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-11120 Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: GeoVision Product: Multiple Devices Added to CISA KEV: 2025-05-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-28 Known ransomware use: Unknown Wed, 07 May 2025 00:00:00 +0000 CVE-2024-11120 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-6047 Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: GeoVision Product: Multiple Devices Added to CISA KEV: 2025-05-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-28 Known ransomware use: Unknown Wed, 07 May 2025 00:00:00 +0000 CVE-2024-6047 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-27363 FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution. Vendor: FreeType Product: FreeType Added to CISA KEV: 2025-05-06 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-27 Known ransomware use: Unknown Tue, 06 May 2025 00:00:00 +0000 CVE-2025-27363 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-3248 Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Vendor: Langflow Product: Langflow Added to CISA KEV: 2025-05-05 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-26 Known ransomware use: Known Mon, 05 May 2025 00:00:00 +0000 CVE-2025-3248 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-34028 Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. Vendor: Commvault Product: Command Center Added to CISA KEV: 2025-05-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-23 Known ransomware use: Unknown Fri, 02 May 2025 00:00:00 +0000 CVE-2025-34028 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-58136 Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432. Vendor: Yiiframework Product: Yii Added to CISA KEV: 2025-05-02 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-23 Known ransomware use: Unknown Fri, 02 May 2025 00:00:00 +0000 CVE-2024-58136 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38475 Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Vendor: Apache Product: HTTP Server Added to CISA KEV: 2025-05-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-22 Known ransomware use: Unknown Thu, 01 May 2025 00:00:00 +0000 CVE-2024-38475 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-44221 SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. Vendor: SonicWall Product: SMA100 Appliances Added to CISA KEV: 2025-05-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-22 Known ransomware use: Unknown Thu, 01 May 2025 00:00:00 +0000 CVE-2023-44221 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31324 SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2025-04-29 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-20 Known ransomware use: Known Tue, 29 Apr 2025 00:00:00 +0000 CVE-2025-31324 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-1976 Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. Vendor: Broadcom Product: Brocade Fabric OS Added to CISA KEV: 2025-04-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-19 Known ransomware use: Unknown Mon, 28 Apr 2025 00:00:00 +0000 CVE-2025-1976 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-42599 Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request. Vendor: Qualitia Product: Active! Mail Added to CISA KEV: 2025-04-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-19 Known ransomware use: Unknown Mon, 28 Apr 2025 00:00:00 +0000 CVE-2025-42599 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-3928 Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells. Vendor: Commvault Product: Web Server Added to CISA KEV: 2025-04-28 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-19 Known ransomware use: Unknown Mon, 28 Apr 2025 00:00:00 +0000 CVE-2025-3928 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24054 Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-04-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-08 Known ransomware use: Unknown Thu, 17 Apr 2025 00:00:00 +0000 CVE-2025-24054 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31201 Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-04-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-08 Known ransomware use: Unknown Thu, 17 Apr 2025 00:00:00 +0000 CVE-2025-31201 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31200 Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-04-17 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-08 Known ransomware use: Unknown Thu, 17 Apr 2025 00:00:00 +0000 CVE-2025-31200 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20035 SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. Vendor: SonicWall Product: SMA100 Appliances Added to CISA KEV: 2025-04-16 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-05-07 Known ransomware use: Unknown Wed, 16 Apr 2025 00:00:00 +0000 CVE-2021-20035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-53150 Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-04-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-30 Known ransomware use: Unknown Wed, 09 Apr 2025 00:00:00 +0000 CVE-2024-53150 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-53197 Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-04-09 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-30 Known ransomware use: Unknown Wed, 09 Apr 2025 00:00:00 +0000 CVE-2024-53197 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-29824 Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-04-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-29 Known ransomware use: Known Tue, 08 Apr 2025 00:00:00 +0000 CVE-2025-29824 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-30406 Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution. Vendor: Gladinet Product: CentreStack Added to CISA KEV: 2025-04-08 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-29 Known ransomware use: Unknown Tue, 08 Apr 2025 00:00:00 +0000 CVE-2025-30406 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-31161 CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Vendor: CrushFTP Product: CrushFTP Added to CISA KEV: 2025-04-07 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-28 Known ransomware use: Known Mon, 07 Apr 2025 00:00:00 +0000 CVE-2025-31161 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Vendor: Ivanti Product: Connect Secure, Policy Secure, and ZTA Gateways Added to CISA KEV: 2025-04-04 CISA required action: Apply mitigations as set forth in the CISA instructions linked below. Federal due date: 2025-04-11 Known ransomware use: Known Fri, 04 Apr 2025 00:00:00 +0000 CVE-2025-22457 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24813 Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Vendor: Apache Product: Tomcat Added to CISA KEV: 2025-04-01 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-22 Known ransomware use: Unknown Tue, 01 Apr 2025 00:00:00 +0000 CVE-2025-24813 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20439 Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. Vendor: Cisco Product: Smart Licensing Utility Added to CISA KEV: 2025-03-31 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-21 Known ransomware use: Unknown Mon, 31 Mar 2025 00:00:00 +0000 CVE-2024-20439 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-2783 Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Mojo Added to CISA KEV: 2025-03-27 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-17 Known ransomware use: Unknown Thu, 27 Mar 2025 00:00:00 +0000 CVE-2025-2783 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9875 Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. Vendor: Sitecore Product: CMS and Experience Platform (XP) Added to CISA KEV: 2025-03-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-16 Known ransomware use: Unknown Wed, 26 Mar 2025 00:00:00 +0000 CVE-2019-9875 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9874 Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. Vendor: Sitecore Product: CMS and Experience Platform (XP) Added to CISA KEV: 2025-03-26 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-16 Known ransomware use: Unknown Wed, 26 Mar 2025 00:00:00 +0000 CVE-2019-9874 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-30154 reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Vendor: reviewdog Product: action-setup GitHub Action Added to CISA KEV: 2025-03-24 CISA required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-14 Known ransomware use: Unknown Mon, 24 Mar 2025 00:00:00 +0000 CVE-2025-30154 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12637 SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2025-03-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-09 Known ransomware use: Unknown Wed, 19 Mar 2025 00:00:00 +0000 CVE-2017-12637 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-48248 NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files. Vendor: NAKIVO Product: Backup and Replication Added to CISA KEV: 2025-03-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-09 Known ransomware use: Unknown Wed, 19 Mar 2025 00:00:00 +0000 CVE-2024-48248 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-1316 Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Vendor: Edimax Product: IC-7100 IP Camera Added to CISA KEV: 2025-03-19 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-09 Known ransomware use: Unknown Wed, 19 Mar 2025 00:00:00 +0000 CVE-2025-1316 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-30066 tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys. Vendor: tj-actions Product: changed-files GitHub Action Added to CISA KEV: 2025-03-18 CISA required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-08 Known ransomware use: Unknown Tue, 18 Mar 2025 00:00:00 +0000 CVE-2025-30066 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24472 Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Vendor: Fortinet Product: FortiOS and FortiProxy Added to CISA KEV: 2025-03-18 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-08 Known ransomware use: Known Tue, 18 Mar 2025 00:00:00 +0000 CVE-2025-24472 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21590 Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2025-03-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-03 Known ransomware use: Unknown Thu, 13 Mar 2025 00:00:00 +0000 CVE-2025-21590 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24201 Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-03-13 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-03 Known ransomware use: Unknown Thu, 13 Mar 2025 00:00:00 +0000 CVE-2025-24201 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24993 Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Unknown Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-24993 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24991 Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Unknown Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-24991 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24985 Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Unknown Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-24985 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24984 Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Unknown Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-24984 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24983 Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Unknown Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-24983 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-26633 Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-11 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-04-01 Known ransomware use: Known Tue, 11 Mar 2025 00:00:00 +0000 CVE-2025-26633 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-13161 Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. Vendor: Ivanti Product: Endpoint Manager (EPM) Added to CISA KEV: 2025-03-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-31 Known ransomware use: Unknown Mon, 10 Mar 2025 00:00:00 +0000 CVE-2024-13161 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-13160 Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. Vendor: Ivanti Product: Endpoint Manager (EPM) Added to CISA KEV: 2025-03-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-31 Known ransomware use: Unknown Mon, 10 Mar 2025 00:00:00 +0000 CVE-2024-13160 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-13159 Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. Vendor: Ivanti Product: Endpoint Manager (EPM) Added to CISA KEV: 2025-03-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-31 Known ransomware use: Unknown Mon, 10 Mar 2025 00:00:00 +0000 CVE-2024-13159 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-57968 Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx. Vendor: Advantive Product: VeraCore Added to CISA KEV: 2025-03-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-31 Known ransomware use: Unknown Mon, 10 Mar 2025 00:00:00 +0000 CVE-2024-57968 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-25181 Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter. Vendor: Advantive Product: VeraCore Added to CISA KEV: 2025-03-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-31 Known ransomware use: Unknown Mon, 10 Mar 2025 00:00:00 +0000 CVE-2025-25181 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-22226 VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. Vendor: VMware Product: ESXi, Workstation, and Fusion Added to CISA KEV: 2025-03-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-25 Known ransomware use: Unknown Tue, 04 Mar 2025 00:00:00 +0000 CVE-2025-22226 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-22225 VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Vendor: VMware Product: ESXi Added to CISA KEV: 2025-03-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-25 Known ransomware use: Known Tue, 04 Mar 2025 00:00:00 +0000 CVE-2025-22225 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-22224 VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. Vendor: VMware Product: ESXi and Workstation Added to CISA KEV: 2025-03-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-25 Known ransomware use: Unknown Tue, 04 Mar 2025 00:00:00 +0000 CVE-2025-22224 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-50302 The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-03-04 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-25 Known ransomware use: Unknown Tue, 04 Mar 2025 00:00:00 +0000 CVE-2024-50302 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4885 Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. Vendor: Progress Product: WhatsUp Gold Added to CISA KEV: 2025-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-24 Known ransomware use: Unknown Mon, 03 Mar 2025 00:00:00 +0000 CVE-2024-4885 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8639 Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-24 Known ransomware use: Known Mon, 03 Mar 2025 00:00:00 +0000 CVE-2018-8639 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-43769 Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution. Vendor: Hitachi Vantara Product: Pentaho Business Analytics (BA) Server Added to CISA KEV: 2025-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-24 Known ransomware use: Unknown Mon, 03 Mar 2025 00:00:00 +0000 CVE-2022-43769 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-43939 Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization. Vendor: Hitachi Vantara Product: Pentaho Business Analytics (BA) Server Added to CISA KEV: 2025-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-24 Known ransomware use: Unknown Mon, 03 Mar 2025 00:00:00 +0000 CVE-2022-43939 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20118 Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. Vendor: Cisco Product: Small Business RV Series Routers Added to CISA KEV: 2025-03-03 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-24 Known ransomware use: Unknown Mon, 03 Mar 2025 00:00:00 +0000 CVE-2023-20118 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2025-02-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-18 Known ransomware use: Unknown Tue, 25 Feb 2025 00:00:00 +0000 CVE-2023-34192 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-49035 Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges. Vendor: Microsoft Product: Partner Center Added to CISA KEV: 2025-02-25 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-18 Known ransomware use: Unknown Tue, 25 Feb 2025 00:00:00 +0000 CVE-2024-49035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system. Vendor: Oracle Product: Agile Product Lifecycle Management (PLM) Added to CISA KEV: 2025-02-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-17 Known ransomware use: Unknown Mon, 24 Feb 2025 00:00:00 +0000 CVE-2024-20953 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-3066 Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2025-02-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-17 Known ransomware use: Unknown Mon, 24 Feb 2025 00:00:00 +0000 CVE-2017-3066 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24989 Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. Vendor: Microsoft Product: Power Pages Added to CISA KEV: 2025-02-21 CISA required action: Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-14 Known ransomware use: Unknown Fri, 21 Feb 2025 00:00:00 +0000 CVE-2025-24989 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-0111 Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2025-02-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-13 Known ransomware use: Unknown Thu, 20 Feb 2025 00:00:00 +0000 CVE-2025-0111 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-23209 Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution. Vendor: Craft CMS Product: Craft CMS Added to CISA KEV: 2025-02-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-13 Known ransomware use: Unknown Thu, 20 Feb 2025 00:00:00 +0000 CVE-2025-23209 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-0108 Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2025-02-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-11 Known ransomware use: Unknown Tue, 18 Feb 2025 00:00:00 +0000 CVE-2025-0108 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-53704 SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Vendor: SonicWall Product: SonicOS Added to CISA KEV: 2025-02-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-11 Known ransomware use: Known Tue, 18 Feb 2025 00:00:00 +0000 CVE-2024-53704 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-57727 SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. Vendor: SimpleHelp Product: SimpleHelp Added to CISA KEV: 2025-02-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-06 Known ransomware use: Known Thu, 13 Feb 2025 00:00:00 +0000 CVE-2024-57727 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24200 Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. Vendor: Apple Product: iOS and iPadOS Added to CISA KEV: 2025-02-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-05 Known ransomware use: Unknown Wed, 12 Feb 2025 00:00:00 +0000 CVE-2025-24200 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-41710 Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. Vendor: Mitel Product: SIP Phones Added to CISA KEV: 2025-02-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-05 Known ransomware use: Unknown Wed, 12 Feb 2025 00:00:00 +0000 CVE-2024-41710 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-40891 Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. Vendor: Zyxel Product: DSL CPE Devices Added to CISA KEV: 2025-02-11 CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. Federal due date: 2025-03-04 Known ransomware use: Unknown Tue, 11 Feb 2025 00:00:00 +0000 CVE-2024-40891 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-40890 Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. Vendor: Zyxel Product: DSL CPE Devices Added to CISA KEV: 2025-02-11 CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. Federal due date: 2025-03-04 Known ransomware use: Unknown Tue, 11 Feb 2025 00:00:00 +0000 CVE-2024-40890 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21418 Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-02-11 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-04 Known ransomware use: Unknown Tue, 11 Feb 2025 00:00:00 +0000 CVE-2025-21418 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21391 Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-02-11 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-03-04 Known ransomware use: Unknown Tue, 11 Feb 2025 00:00:00 +0000 CVE-2025-21391 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-0994 Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server. Vendor: Trimble Product: Cityworks Added to CISA KEV: 2025-02-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-28 Known ransomware use: Unknown Fri, 07 Feb 2025 00:00:00 +0000 CVE-2025-0994 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-15069 Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. Vendor: Sophos Product: XG Firewall Added to CISA KEV: 2025-02-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-27 Known ransomware use: Unknown Thu, 06 Feb 2025 00:00:00 +0000 CVE-2020-15069 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-29574 CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. Vendor: Sophos Product: CyberoamOS Added to CISA KEV: 2025-02-06 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2025-02-27 Known ransomware use: Known Thu, 06 Feb 2025 00:00:00 +0000 CVE-2020-29574 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21413 Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. Vendor: Microsoft Product: Office Outlook Added to CISA KEV: 2025-02-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-27 Known ransomware use: Unknown Thu, 06 Feb 2025 00:00:00 +0000 CVE-2024-21413 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-23748 Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code. Vendor: Audinate Product: Dante Discovery Added to CISA KEV: 2025-02-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-27 Known ransomware use: Unknown Thu, 06 Feb 2025 00:00:00 +0000 CVE-2022-23748 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-0411 7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user. Vendor: 7-Zip Product: 7-Zip Added to CISA KEV: 2025-02-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-27 Known ransomware use: Unknown Thu, 06 Feb 2025 00:00:00 +0000 CVE-2025-0411 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-53104 Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. Vendor: Linux Product: Kernel Added to CISA KEV: 2025-02-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-26 Known ransomware use: Unknown Wed, 05 Feb 2025 00:00:00 +0000 CVE-2024-53104 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19410 Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator). Vendor: Paessler Product: PRTG Network Monitor Added to CISA KEV: 2025-02-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-25 Known ransomware use: Unknown Tue, 04 Feb 2025 00:00:00 +0000 CVE-2018-19410 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-9276 Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. Vendor: Paessler Product: PRTG Network Monitor Added to CISA KEV: 2025-02-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-25 Known ransomware use: Unknown Tue, 04 Feb 2025 00:00:00 +0000 CVE-2018-9276 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-29059 Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. Vendor: Microsoft Product: .NET Framework Added to CISA KEV: 2025-02-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-25 Known ransomware use: Unknown Tue, 04 Feb 2025 00:00:00 +0000 CVE-2024-29059 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-45195 Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. Vendor: Apache Product: OFBiz Added to CISA KEV: 2025-02-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-25 Known ransomware use: Unknown Tue, 04 Feb 2025 00:00:00 +0000 CVE-2024-45195 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-24085 Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2025-01-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-19 Known ransomware use: Unknown Wed, 29 Jan 2025 00:00:00 +0000 CVE-2025-24085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-23006 SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands. Vendor: SonicWall Product: SMA1000 Appliances Added to CISA KEV: 2025-01-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-14 Known ransomware use: Known Fri, 24 Jan 2025 00:00:00 +0000 CVE-2025-23006 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11023 JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser. Vendor: JQuery Product: JQuery Added to CISA KEV: 2025-01-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-13 Known ransomware use: Unknown Thu, 23 Jan 2025 00:00:00 +0000 CVE-2020-11023 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-50603 Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test. Vendor: Aviatrix Product: Controllers Added to CISA KEV: 2025-01-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-06 Known ransomware use: Unknown Thu, 16 Jan 2025 00:00:00 +0000 CVE-2024-50603 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-01-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-04 Known ransomware use: Unknown Tue, 14 Jan 2025 00:00:00 +0000 CVE-2025-21335 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21334 Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-01-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-04 Known ransomware use: Unknown Tue, 14 Jan 2025 00:00:00 +0000 CVE-2025-21334 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2025-01-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-04 Known ransomware use: Unknown Tue, 14 Jan 2025 00:00:00 +0000 CVE-2025-21333 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-55591 Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Vendor: Fortinet Product: FortiOS and FortiProxy Added to CISA KEV: 2025-01-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-21 Known ransomware use: Known Tue, 14 Jan 2025 00:00:00 +0000 CVE-2024-55591 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-48365 Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. Vendor: Qlik Product: Sense Added to CISA KEV: 2025-01-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-03 Known ransomware use: Known Mon, 13 Jan 2025 00:00:00 +0000 CVE-2023-48365 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user. Vendor: BeyondTrust Product: Privileged Remote Access (PRA) and Remote Support (RS) Added to CISA KEV: 2025-01-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-02-03 Known ransomware use: Unknown Mon, 13 Jan 2025 00:00:00 +0000 CVE-2024-12686 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution. Vendor: Ivanti Product: Connect Secure, Policy Secure, and ZTA Gateways Added to CISA KEV: 2025-01-08 CISA required action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service. Federal due date: 2025-01-15 Known ransomware use: Known Wed, 08 Jan 2025 00:00:00 +0000 CVE-2025-0282 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2883 Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2025-01-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-28 Known ransomware use: Unknown Tue, 07 Jan 2025 00:00:00 +0000 CVE-2020-2883 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-55550 Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Vendor: Mitel Product: MiCollab Added to CISA KEV: 2025-01-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-28 Known ransomware use: Known Tue, 07 Jan 2025 00:00:00 +0000 CVE-2024-55550 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-41713 Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Vendor: Mitel Product: MiCollab Added to CISA KEV: 2025-01-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-28 Known ransomware use: Known Tue, 07 Jan 2025 00:00:00 +0000 CVE-2024-41713 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-3393 Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2024-12-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-20 Known ransomware use: Unknown Mon, 30 Dec 2024 00:00:00 +0000 CVE-2024-3393 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44207 Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel. Vendor: Acclaim Systems Product: USAHERDS Added to CISA KEV: 2024-12-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation. Federal due date: 2025-01-13 Known ransomware use: Unknown Mon, 23 Dec 2024 00:00:00 +0000 CVE-2021-44207 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user. Vendor: BeyondTrust Product: Privileged Remote Access (PRA) and Remote Support (RS) Added to CISA KEV: 2024-12-19 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-27 Known ransomware use: Unknown Thu, 19 Dec 2024 00:00:00 +0000 CVE-2024-12356 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40407 Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Vendor: Reolink Product: RLC-410W IP Camera Added to CISA KEV: 2024-12-18 CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. Federal due date: 2025-01-08 Known ransomware use: Unknown Wed, 18 Dec 2024 00:00:00 +0000 CVE-2021-40407 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11001 Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root. Vendor: Reolink Product: Multiple IP Cameras Added to CISA KEV: 2024-12-18 CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. Federal due date: 2025-01-08 Known ransomware use: Unknown Wed, 18 Dec 2024 00:00:00 +0000 CVE-2019-11001 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-23227 NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Vendor: NUUO Product: NVRmini2 Devices Added to CISA KEV: 2024-12-18 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2025-01-08 Known ransomware use: Unknown Wed, 18 Dec 2024 00:00:00 +0000 CVE-2022-23227 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14933 NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Vendor: NUUO Product: NVRmini Devices Added to CISA KEV: 2024-12-18 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2025-01-08 Known ransomware use: Unknown Wed, 18 Dec 2024 00:00:00 +0000 CVE-2018-14933 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-55956 Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. Vendor: Cleo Product: Multiple Products Added to CISA KEV: 2024-12-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-07 Known ransomware use: Known Tue, 17 Dec 2024 00:00:00 +0000 CVE-2024-55956 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-35250 Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-12-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-06 Known ransomware use: Unknown Mon, 16 Dec 2024 00:00:00 +0000 CVE-2024-35250 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20767 Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2024-12-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-06 Known ransomware use: Unknown Mon, 16 Dec 2024 00:00:00 +0000 CVE-2024-20767 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-50623 Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges. Vendor: Cleo Product: Multiple Products Added to CISA KEV: 2024-12-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2025-01-03 Known ransomware use: Known Fri, 13 Dec 2024 00:00:00 +0000 CVE-2024-50623 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-12-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-31 Known ransomware use: Unknown Tue, 10 Dec 2024 00:00:00 +0000 CVE-2024-49138 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-51378 CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Vendor: CyberPersons Product: CyberPanel Added to CISA KEV: 2024-12-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-25 Known ransomware use: Known Wed, 04 Dec 2024 00:00:00 +0000 CVE-2024-51378 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-11667 Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Vendor: Zyxel Product: Multiple Firewalls Added to CISA KEV: 2024-12-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-24 Known ransomware use: Known Tue, 03 Dec 2024 00:00:00 +0000 CVE-2024-11667 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-11680 ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Vendor: ProjectSend Product: ProjectSend Added to CISA KEV: 2024-12-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-24 Known ransomware use: Unknown Tue, 03 Dec 2024 00:00:00 +0000 CVE-2024-11680 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-45727 North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. Vendor: North Grid Product: Proself Added to CISA KEV: 2024-12-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-24 Known ransomware use: Unknown Tue, 03 Dec 2024 00:00:00 +0000 CVE-2023-45727 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28461 Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. Vendor: Array Networks Product: AG/vxAG ArrayOS Added to CISA KEV: 2024-11-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-16 Known ransomware use: Known Mon, 25 Nov 2024 00:00:00 +0000 CVE-2023-28461 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. Vendor: Oracle Product: Agile Product Lifecycle Management (PLM) Added to CISA KEV: 2024-11-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-12 Known ransomware use: Unknown Thu, 21 Nov 2024 00:00:00 +0000 CVE-2024-21287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-44309 Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-11-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-12 Known ransomware use: Unknown Thu, 21 Nov 2024 00:00:00 +0000 CVE-2024-44309 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-44308 Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-11-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-12 Known ransomware use: Unknown Thu, 21 Nov 2024 00:00:00 +0000 CVE-2024-44308 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38813 VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2024-11-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-11 Known ransomware use: Unknown Wed, 20 Nov 2024 00:00:00 +0000 CVE-2024-38813 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38812 VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2024-11-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-11 Known ransomware use: Unknown Wed, 20 Nov 2024 00:00:00 +0000 CVE-2024-38812 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9474 Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2024-11-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet. Federal due date: 2024-12-09 Known ransomware use: Known Mon, 18 Nov 2024 00:00:00 +0000 CVE-2024-9474 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-0012 Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2024-11-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet. Federal due date: 2024-12-09 Known ransomware use: Known Mon, 18 Nov 2024 00:00:00 +0000 CVE-2024-0012 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-1212 Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Vendor: Progress Product: Kemp LoadMaster Added to CISA KEV: 2024-11-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-09 Known ransomware use: Unknown Mon, 18 Nov 2024 00:00:00 +0000 CVE-2024-1212 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9465 Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Vendor: Palo Alto Networks Product: Expedition Added to CISA KEV: 2024-11-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-05 Known ransomware use: Unknown Thu, 14 Nov 2024 00:00:00 +0000 CVE-2024-9465 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9463 Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. Vendor: Palo Alto Networks Product: Expedition Added to CISA KEV: 2024-11-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-05 Known ransomware use: Unknown Thu, 14 Nov 2024 00:00:00 +0000 CVE-2024-9463 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26086 Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. Vendor: Atlassian Product: Jira Server and Data Center Added to CISA KEV: 2024-11-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-03 Known ransomware use: Unknown Tue, 12 Nov 2024 00:00:00 +0000 CVE-2021-26086 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-2120 Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Vendor: Cisco Product: Adaptive Security Appliance (ASA) Added to CISA KEV: 2024-11-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-03 Known ransomware use: Unknown Tue, 12 Nov 2024 00:00:00 +0000 CVE-2014-2120 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-41277 Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. Vendor: Metabase Product: Metabase Added to CISA KEV: 2024-11-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-03 Known ransomware use: Unknown Tue, 12 Nov 2024 00:00:00 +0000 CVE-2021-41277 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43451 Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-11-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-03 Known ransomware use: Unknown Tue, 12 Nov 2024 00:00:00 +0000 CVE-2024-43451 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-49039 Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-11-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-12-03 Known ransomware use: Known Tue, 12 Nov 2024 00:00:00 +0000 CVE-2024-49039 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16278 Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution. Vendor: Nostromo Product: nhttpd Added to CISA KEV: 2024-11-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-28 Known ransomware use: Unknown Thu, 07 Nov 2024 00:00:00 +0000 CVE-2019-16278 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-51567 CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. Vendor: CyberPersons Product: CyberPanel Added to CISA KEV: 2024-11-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-28 Known ransomware use: Known Thu, 07 Nov 2024 00:00:00 +0000 CVE-2024-51567 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43093 Android Framework contains an unspecified vulnerability that allows for privilege escalation. Vendor: Android Product: Framework Added to CISA KEV: 2024-11-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-28 Known ransomware use: Unknown Thu, 07 Nov 2024 00:00:00 +0000 CVE-2024-43093 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-5910 Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. Vendor: Palo Alto Networks Product: Expedition Added to CISA KEV: 2024-11-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-28 Known ransomware use: Unknown Thu, 07 Nov 2024 00:00:00 +0000 CVE-2024-5910 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8956 PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root. Vendor: PTZOptics Product: PT30X-SDI/NDI Cameras Added to CISA KEV: 2024-11-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-25 Known ransomware use: Unknown Mon, 04 Nov 2024 00:00:00 +0000 CVE-2024-8956 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8957 PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. Vendor: PTZOptics Product: PT30X-SDI/NDI Cameras Added to CISA KEV: 2024-11-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-25 Known ransomware use: Unknown Mon, 04 Nov 2024 00:00:00 +0000 CVE-2024-8957 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-37383 RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2024-10-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-14 Known ransomware use: Unknown Thu, 24 Oct 2024 00:00:00 +0000 CVE-2024-37383 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20481 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2024-10-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-14 Known ransomware use: Unknown Thu, 24 Oct 2024 00:00:00 +0000 CVE-2024-20481 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-47575 Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Vendor: Fortinet Product: FortiManager Added to CISA KEV: 2024-10-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-13 Known ransomware use: Unknown Wed, 23 Oct 2024 00:00:00 +0000 CVE-2024-47575 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38094 Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2024-10-22 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-12 Known ransomware use: Known Tue, 22 Oct 2024 00:00:00 +0000 CVE-2024-38094 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9537 ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component. Vendor: ScienceLogic Product: SL1 Added to CISA KEV: 2024-10-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-11 Known ransomware use: Unknown Mon, 21 Oct 2024 00:00:00 +0000 CVE-2024-9537 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-40711 Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. Vendor: Veeam Product: Backup & Replication Added to CISA KEV: 2024-10-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-07 Known ransomware use: Known Thu, 17 Oct 2024 00:00:00 +0000 CVE-2024-40711 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-28987 SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. Vendor: SolarWinds Product: Web Help Desk Added to CISA KEV: 2024-10-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-05 Known ransomware use: Unknown Tue, 15 Oct 2024 00:00:00 +0000 CVE-2024-28987 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9680 Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. Vendor: Mozilla Product: Firefox Added to CISA KEV: 2024-10-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-05 Known ransomware use: Known Tue, 15 Oct 2024 00:00:00 +0000 CVE-2024-9680 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-30088 Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-10-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-11-05 Known ransomware use: Known Tue, 15 Oct 2024 00:00:00 +0000 CVE-2024-30088 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. Vendor: Ivanti Product: Cloud Services Appliance (CSA) Added to CISA KEV: 2024-10-09 CISA required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution. Federal due date: 2024-10-30 Known ransomware use: Unknown Wed, 09 Oct 2024 00:00:00 +0000 CVE-2024-9380 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements. Vendor: Ivanti Product: Cloud Services Appliance (CSA) Added to CISA KEV: 2024-10-09 CISA required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution. Federal due date: 2024-10-30 Known ransomware use: Unknown Wed, 09 Oct 2024 00:00:00 +0000 CVE-2024-9379 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23113 Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2024-10-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-30 Known ransomware use: Unknown Wed, 09 Oct 2024 00:00:00 +0000 CVE-2024-23113 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43573 Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-10-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-29 Known ransomware use: Unknown Tue, 08 Oct 2024 00:00:00 +0000 CVE-2024-43573 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43572 Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-10-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-29 Known ransomware use: Unknown Tue, 08 Oct 2024 00:00:00 +0000 CVE-2024-43572 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43047 Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2024-10-08 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2024-10-29 Known ransomware use: Unknown Tue, 08 Oct 2024 00:00:00 +0000 CVE-2024-43047 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2024-10-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-24 Known ransomware use: Unknown Thu, 03 Oct 2024 00:00:00 +0000 CVE-2024-45519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-29824 Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Vendor: Ivanti Product: Endpoint Manager (EPM) Added to CISA KEV: 2024-10-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-23 Known ransomware use: Unknown Wed, 02 Oct 2024 00:00:00 +0000 CVE-2024-29824 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0344 SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. Vendor: SAP Product: Commerce Cloud Added to CISA KEV: 2024-09-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-21 Known ransomware use: Unknown Mon, 30 Sep 2024 00:00:00 +0000 CVE-2019-0344 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-15415 DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Vendor: DrayTek Product: Multiple Vigor Routers Added to CISA KEV: 2024-09-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-21 Known ransomware use: Unknown Mon, 30 Sep 2024 00:00:00 +0000 CVE-2020-15415 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-25280 D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Vendor: D-Link Product: DIR-820 Router Added to CISA KEV: 2024-09-30 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2024-10-21 Known ransomware use: Unknown Mon, 30 Sep 2024 00:00:00 +0000 CVE-2023-25280 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7593 Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Vendor: Ivanti Product: Virtual Traffic Manager Added to CISA KEV: 2024-09-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-15 Known ransomware use: Unknown Tue, 24 Sep 2024 00:00:00 +0000 CVE-2024-7593 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance. Vendor: Ivanti Product: Cloud Services Appliance (CSA) Added to CISA KEV: 2024-09-19 CISA required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates. Federal due date: 2024-10-10 Known ransomware use: Unknown Thu, 19 Sep 2024 00:00:00 +0000 CVE-2024-8963 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14644 Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2024-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-09 Known ransomware use: Unknown Wed, 18 Sep 2024 00:00:00 +0000 CVE-2020-14644 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21445 Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Vendor: Oracle Product: ADF Faces Added to CISA KEV: 2024-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-09 Known ransomware use: Unknown Wed, 18 Sep 2024 00:00:00 +0000 CVE-2022-21445 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0618 Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Vendor: Microsoft Product: SQL Server Added to CISA KEV: 2024-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-09 Known ransomware use: Known Wed, 18 Sep 2024 00:00:00 +0000 CVE-2020-0618 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-27348 Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Vendor: Apache Product: HugeGraph-Server Added to CISA KEV: 2024-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-09 Known ransomware use: Unknown Wed, 18 Sep 2024 00:00:00 +0000 CVE-2024-27348 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0502 Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2024-09-17 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2024-10-08 Known ransomware use: Unknown Tue, 17 Sep 2024 00:00:00 +0000 CVE-2014-0502 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0648 Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2024-09-17 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2024-10-08 Known ransomware use: Unknown Tue, 17 Sep 2024 00:00:00 +0000 CVE-2013-0648 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0643 Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2024-09-17 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2024-10-08 Known ransomware use: Unknown Tue, 17 Sep 2024 00:00:00 +0000 CVE-2013-0643 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0497 Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2024-09-17 CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal due date: 2024-10-08 Known ransomware use: Unknown Tue, 17 Sep 2024 00:00:00 +0000 CVE-2014-0497 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-6670 Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Vendor: Progress Product: WhatsUp Gold Added to CISA KEV: 2024-09-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-07 Known ransomware use: Known Mon, 16 Sep 2024 00:00:00 +0000 CVE-2024-6670 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-43461 Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-09-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-07 Known ransomware use: Unknown Mon, 16 Sep 2024 00:00:00 +0000 CVE-2024-43461 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-8190 Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. Vendor: Ivanti Product: Cloud Services Appliance Added to CISA KEV: 2024-09-13 CISA required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates. Federal due date: 2024-10-04 Known ransomware use: Unknown Fri, 13 Sep 2024 00:00:00 +0000 CVE-2024-8190 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38217 Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-09-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-01 Known ransomware use: Unknown Tue, 10 Sep 2024 00:00:00 +0000 CVE-2024-38217 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38014 Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-09-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-01 Known ransomware use: Unknown Tue, 10 Sep 2024 00:00:00 +0000 CVE-2024-38014 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38226 Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Vendor: Microsoft Product: Publisher Added to CISA KEV: 2024-09-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-10-01 Known ransomware use: Unknown Tue, 10 Sep 2024 00:00:00 +0000 CVE-2024-38226 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-40766 SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. Vendor: SonicWall Product: SonicOS Added to CISA KEV: 2024-09-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-30 Known ransomware use: Known Mon, 09 Sep 2024 00:00:00 +0000 CVE-2024-40766 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-1000253 Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Vendor: Linux Product: Kernel Added to CISA KEV: 2024-09-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-30 Known ransomware use: Known Mon, 09 Sep 2024 00:00:00 +0000 CVE-2017-1000253 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3714 ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image. Vendor: ImageMagick Product: ImageMagick Added to CISA KEV: 2024-09-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-30 Known ransomware use: Unknown Mon, 09 Sep 2024 00:00:00 +0000 CVE-2016-3714 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7262 Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. Vendor: Kingsoft Product: WPS Office Added to CISA KEV: 2024-09-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-24 Known ransomware use: Unknown Tue, 03 Sep 2024 00:00:00 +0000 CVE-2024-7262 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20124 Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Vendor: DrayTek Product: VigorConnect Added to CISA KEV: 2024-09-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-24 Known ransomware use: Unknown Tue, 03 Sep 2024 00:00:00 +0000 CVE-2021-20124 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20123 Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Vendor: DrayTek Product: VigorConnect Added to CISA KEV: 2024-09-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-24 Known ransomware use: Unknown Tue, 03 Sep 2024 00:00:00 +0000 CVE-2021-20123 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7965 Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-08-28 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-18 Known ransomware use: Unknown Wed, 28 Aug 2024 00:00:00 +0000 CVE-2024-7965 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38856 Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Vendor: Apache Product: OFBiz Added to CISA KEV: 2024-08-27 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-17 Known ransomware use: Unknown Tue, 27 Aug 2024 00:00:00 +0000 CVE-2024-38856 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-7971 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-08-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-16 Known ransomware use: Unknown Mon, 26 Aug 2024 00:00:00 +0000 CVE-2024-7971 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-39717 The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image. Vendor: Versa Product: Director Added to CISA KEV: 2024-08-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-13 Known ransomware use: Unknown Fri, 23 Aug 2024 00:00:00 +0000 CVE-2024-39717 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31196 Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2024-08-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-11 Known ransomware use: Unknown Wed, 21 Aug 2024 00:00:00 +0000 CVE-2021-31196 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0185 Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. Vendor: Linux Product: Kernel Added to CISA KEV: 2024-08-21 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2024-09-11 Known ransomware use: Unknown Wed, 21 Aug 2024 00:00:00 +0000 CVE-2022-0185 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33045 Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. Vendor: Dahua Product: IP Camera Firmware Added to CISA KEV: 2024-08-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-11 Known ransomware use: Unknown Wed, 21 Aug 2024 00:00:00 +0000 CVE-2021-33045 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33044 Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. Vendor: Dahua Product: IP Camera Firmware Added to CISA KEV: 2024-08-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-11 Known ransomware use: Unknown Wed, 21 Aug 2024 00:00:00 +0000 CVE-2021-33044 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23897 Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Vendor: Jenkins Product: Jenkins Command Line Interface (CLI) Added to CISA KEV: 2024-08-19 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-09 Known ransomware use: Known Mon, 19 Aug 2024 00:00:00 +0000 CVE-2024-23897 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-28986 SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. Vendor: SolarWinds Product: Web Help Desk Added to CISA KEV: 2024-08-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-05 Known ransomware use: Unknown Thu, 15 Aug 2024 00:00:00 +0000 CVE-2024-28986 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38107 Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38107 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38106 Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38106 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38193 Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38213 Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38213 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38178 Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38178 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38189 Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. Vendor: Microsoft Product: Project Added to CISA KEV: 2024-08-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-09-03 Known ransomware use: Unknown Tue, 13 Aug 2024 00:00:00 +0000 CVE-2024-38189 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-32113 Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Vendor: Apache Product: OFBiz Added to CISA KEV: 2024-08-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-28 Known ransomware use: Unknown Wed, 07 Aug 2024 00:00:00 +0000 CVE-2024-32113 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-36971 Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. Vendor: Android Product: Kernel Added to CISA KEV: 2024-08-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-28 Known ransomware use: Unknown Wed, 07 Aug 2024 00:00:00 +0000 CVE-2024-36971 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0824 Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-08-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-26 Known ransomware use: Unknown Mon, 05 Aug 2024 00:00:00 +0000 CVE-2018-0824 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-37085 VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Vendor: VMware Product: ESXi Added to CISA KEV: 2024-07-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-20 Known ransomware use: Known Tue, 30 Jul 2024 00:00:00 +0000 CVE-2024-37085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-45249 Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. Vendor: Acronis Product: Cyber Infrastructure (ACI) Added to CISA KEV: 2024-07-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-19 Known ransomware use: Unknown Mon, 29 Jul 2024 00:00:00 +0000 CVE-2023-45249 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-5217 ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. Vendor: ServiceNow Product: Utah, Vancouver, and Washington DC Now Platform Added to CISA KEV: 2024-07-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-19 Known ransomware use: Unknown Mon, 29 Jul 2024 00:00:00 +0000 CVE-2024-5217 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4879 ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. Vendor: ServiceNow Product: Utah, Vancouver, and Washington DC Now Platform Added to CISA KEV: 2024-07-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-19 Known ransomware use: Unknown Mon, 29 Jul 2024 00:00:00 +0000 CVE-2024-4879 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-39891 Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy. Vendor: Twilio Product: Authy Added to CISA KEV: 2024-07-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-13 Known ransomware use: Unknown Tue, 23 Jul 2024 00:00:00 +0000 CVE-2024-39891 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-4792 Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2024-07-23 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2024-08-13 Known ransomware use: Unknown Tue, 23 Jul 2024 00:00:00 +0000 CVE-2012-4792 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22948 VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2024-07-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-07 Known ransomware use: Unknown Wed, 17 Jul 2024 00:00:00 +0000 CVE-2022-22948 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-28995 SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine. Vendor: SolarWinds Product: Serv-U Added to CISA KEV: 2024-07-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-07 Known ransomware use: Unknown Wed, 17 Jul 2024 00:00:00 +0000 CVE-2024-28995 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-34102 Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. Vendor: Adobe Product: Commerce and Magento Open Source Added to CISA KEV: 2024-07-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-07 Known ransomware use: Unknown Wed, 17 Jul 2024 00:00:00 +0000 CVE-2024-34102 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-36401 OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Vendor: OSGeo Product: GeoServer Added to CISA KEV: 2024-07-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-08-05 Known ransomware use: Unknown Mon, 15 Jul 2024 00:00:00 +0000 CVE-2024-36401 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23692 Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request. Vendor: Rejetto Product: HTTP File Server Added to CISA KEV: 2024-07-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-30 Known ransomware use: Known Tue, 09 Jul 2024 00:00:00 +0000 CVE-2024-23692 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38080 Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-07-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-30 Known ransomware use: Unknown Tue, 09 Jul 2024 00:00:00 +0000 CVE-2024-38080 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-38112 Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-07-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-30 Known ransomware use: Unknown Tue, 09 Jul 2024 00:00:00 +0000 CVE-2024-38112 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20399 Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Vendor: Cisco Product: NX-OS Added to CISA KEV: 2024-07-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-23 Known ransomware use: Unknown Tue, 02 Jul 2024 00:00:00 +0000 CVE-2024-20399 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-13965 Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2024-06-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-17 Known ransomware use: Unknown Wed, 26 Jun 2024 00:00:00 +0000 CVE-2020-13965 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-2586 Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Vendor: Linux Product: Kernel Added to CISA KEV: 2024-06-26 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2024-07-17 Known ransomware use: Unknown Wed, 26 Jun 2024 00:00:00 +0000 CVE-2022-2586 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24816 OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Vendor: OSGeo Product: JAI-EXT Added to CISA KEV: 2024-06-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-17 Known ransomware use: Unknown Wed, 26 Jun 2024 00:00:00 +0000 CVE-2022-24816 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4358 Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Vendor: Progress Product: Telerik Report Server Added to CISA KEV: 2024-06-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-04 Known ransomware use: Unknown Thu, 13 Jun 2024 00:00:00 +0000 CVE-2024-4358 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-26169 Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-06-13 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2024-07-04 Known ransomware use: Known Thu, 13 Jun 2024 00:00:00 +0000 CVE-2024-26169 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-32896 Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. Vendor: Android Product: Pixel Added to CISA KEV: 2024-06-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-04 Known ransomware use: Unknown Thu, 13 Jun 2024 00:00:00 +0000 CVE-2024-32896 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4577 PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823. Vendor: PHP Group Product: PHP Added to CISA KEV: 2024-06-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-03 Known ransomware use: Known Wed, 12 Jun 2024 00:00:00 +0000 CVE-2024-4577 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4610 Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. Vendor: Arm Product: Mali GPU Kernel Driver Added to CISA KEV: 2024-06-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-07-03 Known ransomware use: Unknown Wed, 12 Jun 2024 00:00:00 +0000 CVE-2024-4610 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-3506 Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2024-06-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-24 Known ransomware use: Unknown Mon, 03 Jun 2024 00:00:00 +0000 CVE-2017-3506 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-1086 Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2024-05-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-20 Known ransomware use: Known Thu, 30 May 2024 00:00:00 +0000 CVE-2024-1086 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-24919 Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Vendor: Check Point Product: Quantum Security Gateways Added to CISA KEV: 2024-05-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-20 Known ransomware use: Known Thu, 30 May 2024 00:00:00 +0000 CVE-2024-24919 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4978 Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server. Vendor: Justice AV Solutions Product: Viewer Added to CISA KEV: 2024-05-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-19 Known ransomware use: Unknown Wed, 29 May 2024 00:00:00 +0000 CVE-2024-4978 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-5274 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-05-28 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-18 Known ransomware use: Unknown Tue, 28 May 2024 00:00:00 +0000 CVE-2024-5274 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17519 Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Vendor: Apache Product: Flink Added to CISA KEV: 2024-05-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-13 Known ransomware use: Unknown Thu, 23 May 2024 00:00:00 +0000 CVE-2020-17519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4947 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-05-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-10 Known ransomware use: Unknown Mon, 20 May 2024 00:00:00 +0000 CVE-2024-4947 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-43208 NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Vendor: NextGen Healthcare Product: Mirth Connect Added to CISA KEV: 2024-05-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-10 Known ransomware use: Known Mon, 20 May 2024 00:00:00 +0000 CVE-2023-43208 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4761 Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-05-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-06 Known ransomware use: Unknown Thu, 16 May 2024 00:00:00 +0000 CVE-2024-4761 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40655 D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Vendor: D-Link Product: DIR-605 Router Added to CISA KEV: 2024-05-16 CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Federal due date: 2024-06-06 Known ransomware use: Unknown Thu, 16 May 2024 00:00:00 +0000 CVE-2021-40655 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-100005 D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session. Vendor: D-Link Product: DIR-600 Router Added to CISA KEV: 2024-05-16 CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Federal due date: 2024-06-06 Known ransomware use: Unknown Thu, 16 May 2024 00:00:00 +0000 CVE-2014-100005 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-30040 Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-05-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-04 Known ransomware use: Unknown Tue, 14 May 2024 00:00:00 +0000 CVE-2024-30040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-30051 Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Vendor: Microsoft Product: DWM Core Library Added to CISA KEV: 2024-05-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-04 Known ransomware use: Known Tue, 14 May 2024 00:00:00 +0000 CVE-2024-30051 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4671 Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2024-05-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-06-03 Known ransomware use: Unknown Mon, 13 May 2024 00:00:00 +0000 CVE-2024-4671 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-7028 GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Vendor: GitLab Product: GitLab CE/EE Added to CISA KEV: 2024-05-01 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-22 Known ransomware use: Unknown Wed, 01 May 2024 00:00:00 +0000 CVE-2023-7028 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-29988 Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. Vendor: Microsoft Product: SmartScreen Prompt Added to CISA KEV: 2024-04-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-21 Known ransomware use: Unknown Tue, 30 Apr 2024 00:00:00 +0000 CVE-2024-29988 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-4040 CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). Vendor: CrushFTP Product: CrushFTP Added to CISA KEV: 2024-04-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-01 Known ransomware use: Unknown Wed, 24 Apr 2024 00:00:00 +0000 CVE-2024-4040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20359 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2024-04-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-01 Known ransomware use: Unknown Wed, 24 Apr 2024 00:00:00 +0000 CVE-2024-20359 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-20353 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2024-04-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-01 Known ransomware use: Unknown Wed, 24 Apr 2024 00:00:00 +0000 CVE-2024-20353 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-38028 Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-04-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-05-14 Known ransomware use: Unknown Tue, 23 Apr 2024 00:00:00 +0000 CVE-2022-38028 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-3400 Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2024-04-12 CISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule. Federal due date: 2024-04-19 Known ransomware use: Known Fri, 12 Apr 2024 00:00:00 +0000 CVE-2024-3400 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-3273 D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Vendor: D-Link Product: Multiple NAS Devices Added to CISA KEV: 2024-04-11 CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Federal due date: 2024-05-02 Known ransomware use: Unknown Thu, 11 Apr 2024 00:00:00 +0000 CVE-2024-3273 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-3272 D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. Vendor: D-Link Product: Multiple NAS Devices Added to CISA KEV: 2024-04-11 CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Federal due date: 2024-05-02 Known ransomware use: Unknown Thu, 11 Apr 2024 00:00:00 +0000 CVE-2024-3272 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-29748 Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. Vendor: Android Product: Pixel Added to CISA KEV: 2024-04-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-04-25 Known ransomware use: Unknown Thu, 04 Apr 2024 00:00:00 +0000 CVE-2024-29748 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-29745 Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. Vendor: Android Product: Pixel Added to CISA KEV: 2024-04-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-04-25 Known ransomware use: Unknown Thu, 04 Apr 2024 00:00:00 +0000 CVE-2024-29745 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-24955 Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Vendor: Microsoft Product: SharePoint Server Added to CISA KEV: 2024-03-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-04-16 Known ransomware use: Known Tue, 26 Mar 2024 00:00:00 +0000 CVE-2023-24955 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7256 Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. Vendor: Nice Product: Linear eMerge E3-Series Added to CISA KEV: 2024-03-25 CISA required action: Contact the vendor for guidance on remediating firmware, per their advisory. Federal due date: 2024-04-15 Known ransomware use: Unknown Mon, 25 Mar 2024 00:00:00 +0000 CVE-2019-7256 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Vendor: Ivanti Product: Endpoint Manager Cloud Service Appliance (EPM CSA) Added to CISA KEV: 2024-03-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-04-15 Known ransomware use: Known Mon, 25 Mar 2024 00:00:00 +0000 CVE-2021-44529 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-48788 Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. Vendor: Fortinet Product: FortiClient EMS Added to CISA KEV: 2024-03-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-04-15 Known ransomware use: Known Mon, 25 Mar 2024 00:00:00 +0000 CVE-2023-48788 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-27198 JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Vendor: JetBrains Product: TeamCity Added to CISA KEV: 2024-03-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-28 Known ransomware use: Known Thu, 07 Mar 2024 00:00:00 +0000 CVE-2024-27198 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23225 Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-03-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-27 Known ransomware use: Unknown Wed, 06 Mar 2024 00:00:00 +0000 CVE-2024-23225 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23296 Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-03-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-27 Known ransomware use: Unknown Wed, 06 Mar 2024 00:00:00 +0000 CVE-2024-23296 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21237 Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. Vendor: Android Product: Pixel Added to CISA KEV: 2024-03-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-26 Known ransomware use: Unknown Tue, 05 Mar 2024 00:00:00 +0000 CVE-2023-21237 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36380 Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi. Vendor: Sunhillo Product: SureLine Added to CISA KEV: 2024-03-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-26 Known ransomware use: Unknown Tue, 05 Mar 2024 00:00:00 +0000 CVE-2021-36380 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21338 Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-03-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-25 Known ransomware use: Known Mon, 04 Mar 2024 00:00:00 +0000 CVE-2024-21338 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29360 Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Streaming Service Added to CISA KEV: 2024-02-29 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-21 Known ransomware use: Unknown Thu, 29 Feb 2024 00:00:00 +0000 CVE-2023-29360 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-1709 ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices. Vendor: ConnectWise Product: ScreenConnect Added to CISA KEV: 2024-02-22 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-29 Known ransomware use: Known Thu, 22 Feb 2024 00:00:00 +0000 CVE-2024-1709 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3259 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2024-02-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-07 Known ransomware use: Known Thu, 15 Feb 2024 00:00:00 +0000 CVE-2020-3259 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21410 Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2024-02-15 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-07 Known ransomware use: Unknown Thu, 15 Feb 2024 00:00:00 +0000 CVE-2024-21410 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21412 Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-02-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-05 Known ransomware use: Known Tue, 13 Feb 2024 00:00:00 +0000 CVE-2024-21412 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21351 Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. Vendor: Microsoft Product: Windows Added to CISA KEV: 2024-02-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-05 Known ransomware use: Unknown Tue, 13 Feb 2024 00:00:00 +0000 CVE-2024-21351 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-43770 Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2024-02-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-03-04 Known ransomware use: Unknown Mon, 12 Feb 2024 00:00:00 +0000 CVE-2023-43770 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21762 Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2024-02-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-16 Known ransomware use: Known Fri, 09 Feb 2024 00:00:00 +0000 CVE-2024-21762 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4762 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-02-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-27 Known ransomware use: Unknown Tue, 06 Feb 2024 00:00:00 +0000 CVE-2023-4762 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-48618 Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-01-31 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-21 Known ransomware use: Unknown Wed, 31 Jan 2024 00:00:00 +0000 CVE-2022-48618 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21893 Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication. Vendor: Ivanti Product: Connect Secure, Policy Secure, and Neurons Added to CISA KEV: 2024-01-31 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-02 Known ransomware use: Known Wed, 31 Jan 2024 00:00:00 +0000 CVE-2024-21893 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-22527 Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Vendor: Atlassian Product: Confluence Data Center and Server Added to CISA KEV: 2024-01-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-14 Known ransomware use: Known Wed, 24 Jan 2024 00:00:00 +0000 CVE-2023-22527 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-23222 Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-01-23 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-13 Known ransomware use: Unknown Tue, 23 Jan 2024 00:00:00 +0000 CVE-2024-23222 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-34048 VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2024-01-22 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-12 Known ransomware use: Unknown Mon, 22 Jan 2024 00:00:00 +0000 CVE-2023-34048 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) and MobileIron Core Added to CISA KEV: 2024-01-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-08 Known ransomware use: Known Thu, 18 Jan 2024 00:00:00 +0000 CVE-2023-35082 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-0519 Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2024-01-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-07 Known ransomware use: Unknown Wed, 17 Jan 2024 00:00:00 +0000 CVE-2024-0519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-6549 Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Vendor: Citrix Product: NetScaler ADC and NetScaler Gateway Added to CISA KEV: 2024-01-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-07 Known ransomware use: Unknown Wed, 17 Jan 2024 00:00:00 +0000 CVE-2023-6549 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-6548 Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. Vendor: Citrix Product: NetScaler ADC and NetScaler Gateway Added to CISA KEV: 2024-01-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-24 Known ransomware use: Unknown Wed, 17 Jan 2024 00:00:00 +0000 CVE-2023-6548 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-15133 Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable). Vendor: Laravel Product: Laravel Framework Added to CISA KEV: 2024-01-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-02-06 Known ransomware use: Unknown Tue, 16 Jan 2024 00:00:00 +0000 CVE-2018-15133 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29357 Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Vendor: Microsoft Product: SharePoint Server Added to CISA KEV: 2024-01-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-31 Known ransomware use: Known Wed, 10 Jan 2024 00:00:00 +0000 CVE-2023-29357 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-46805 Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability. Vendor: Ivanti Product: Connect Secure and Policy Secure Added to CISA KEV: 2024-01-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-22 Known ransomware use: Known Wed, 10 Jan 2024 00:00:00 +0000 CVE-2023-46805 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2024-21887 Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue. Vendor: Ivanti Product: Connect Secure and Policy Secure Added to CISA KEV: 2024-01-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-22 Known ransomware use: Known Wed, 10 Jan 2024 00:00:00 +0000 CVE-2024-21887 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-23752 Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. Vendor: Joomla! Product: Joomla! Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Unknown Mon, 08 Jan 2024 00:00:00 +0000 CVE-2023-23752 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-20017 D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Vendor: D-Link Product: DSL-2750B Devices Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Unknown Mon, 08 Jan 2024 00:00:00 +0000 CVE-2016-20017 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41990 Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Unknown Mon, 08 Jan 2024 00:00:00 +0000 CVE-2023-41990 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27524 Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Vendor: Apache Product: Superset Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Unknown Mon, 08 Jan 2024 00:00:00 +0000 CVE-2023-27524 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29300 Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Known Mon, 08 Jan 2024 00:00:00 +0000 CVE-2023-29300 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38203 Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2024-01-08 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-29 Known ransomware use: Known Mon, 08 Jan 2024 00:00:00 +0000 CVE-2023-38203 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-7101 Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic. Vendor: Spreadsheet::ParseExcel Product: Spreadsheet::ParseExcel Added to CISA KEV: 2024-01-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-23 Known ransomware use: Unknown Tue, 02 Jan 2024 00:00:00 +0000 CVE-2023-7101 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-7024 Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome. Vendor: Google Product: Chromium WebRTC Added to CISA KEV: 2024-01-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-23 Known ransomware use: Unknown Tue, 02 Jan 2024 00:00:00 +0000 CVE-2023-7024 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-49897 FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. Vendor: FXC Product: AE1021, AE1021PE Added to CISA KEV: 2023-12-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-11 Known ransomware use: Unknown Thu, 21 Dec 2023 00:00:00 +0000 CVE-2023-49897 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-47565 QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. Vendor: QNAP Product: VioStor NVR Added to CISA KEV: 2023-12-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2024-01-11 Known ransomware use: Unknown Thu, 21 Dec 2023 00:00:00 +0000 CVE-2023-47565 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-6448 Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands. Vendor: Unitronics Product: Vision PLC and HMI Added to CISA KEV: 2023-12-11 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-18 Known ransomware use: Unknown Mon, 11 Dec 2023 00:00:00 +0000 CVE-2023-6448 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41266 Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints. Vendor: Qlik Product: Sense Added to CISA KEV: 2023-12-07 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-28 Known ransomware use: Known Thu, 07 Dec 2023 00:00:00 +0000 CVE-2023-41266 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41265 Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. Vendor: Qlik Product: Sense Added to CISA KEV: 2023-12-07 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-28 Known ransomware use: Known Thu, 07 Dec 2023 00:00:00 +0000 CVE-2023-41265 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33107 Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2023-12-05 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-26 Known ransomware use: Unknown Tue, 05 Dec 2023 00:00:00 +0000 CVE-2023-33107 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33106 Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2023-12-05 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-26 Known ransomware use: Unknown Tue, 05 Dec 2023 00:00:00 +0000 CVE-2023-33106 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33063 Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2023-12-05 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-26 Known ransomware use: Unknown Tue, 05 Dec 2023 00:00:00 +0000 CVE-2023-33063 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22071 Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2023-12-05 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-26 Known ransomware use: Unknown Tue, 05 Dec 2023 00:00:00 +0000 CVE-2022-22071 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-42917 Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-12-04 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-25 Known ransomware use: Unknown Mon, 04 Dec 2023 00:00:00 +0000 CVE-2023-42917 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-42916 Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-12-04 CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal due date: 2023-12-25 Known ransomware use: Unknown Mon, 04 Dec 2023 00:00:00 +0000 CVE-2023-42916 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-6345 Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Vendor: Google Product: Chromium Skia Added to CISA KEV: 2023-11-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-21 Known ransomware use: Unknown Thu, 30 Nov 2023 00:00:00 +0000 CVE-2023-6345 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-49103 ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials. Vendor: ownCloud Product: ownCloud graphapi Added to CISA KEV: 2023-11-30 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-21 Known ransomware use: Unknown Thu, 30 Nov 2023 00:00:00 +0000 CVE-2023-49103 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4911 GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges. Vendor: GNU Product: GNU C Library Added to CISA KEV: 2023-11-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-12 Known ransomware use: Unknown Tue, 21 Nov 2023 00:00:00 +0000 CVE-2023-4911 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36584 Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-11-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-07 Known ransomware use: Unknown Thu, 16 Nov 2023 00:00:00 +0000 CVE-2023-36584 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-1671 Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Vendor: Sophos Product: Web Appliance Added to CISA KEV: 2023-11-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-07 Known ransomware use: Unknown Thu, 16 Nov 2023 00:00:00 +0000 CVE-2023-1671 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2551 Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server. Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2023-11-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-07 Known ransomware use: Unknown Thu, 16 Nov 2023 00:00:00 +0000 CVE-2020-2551 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36033 Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-11-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-05 Known ransomware use: Unknown Tue, 14 Nov 2023 00:00:00 +0000 CVE-2023-36033 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36025 Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-11-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-05 Known ransomware use: Unknown Tue, 14 Nov 2023 00:00:00 +0000 CVE-2023-36025 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36036 Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-11-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-05 Known ransomware use: Unknown Tue, 14 Nov 2023 00:00:00 +0000 CVE-2023-36036 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-47246 SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. Vendor: SysAid Product: SysAid Server Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-12-04 Known ransomware use: Known Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-47246 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36844 Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-17 Known ransomware use: Unknown Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-36844 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36845 Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-17 Known ransomware use: Unknown Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-36845 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36846 Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-17 Known ransomware use: Unknown Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-36846 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36847 Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-17 Known ransomware use: Unknown Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-36847 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36851 Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2023-11-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-17 Known ransomware use: Unknown Mon, 13 Nov 2023 00:00:00 +0000 CVE-2023-36851 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29552 The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor. Vendor: IETF Product: Service Location Protocol (SLP) Added to CISA KEV: 2023-11-08 CISA required action: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet. Federal due date: 2023-11-29 Known ransomware use: Unknown Wed, 08 Nov 2023 00:00:00 +0000 CVE-2023-29552 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-22518 Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data. Vendor: Atlassian Product: Confluence Data Center and Server Added to CISA KEV: 2023-11-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-28 Known ransomware use: Known Tue, 07 Nov 2023 00:00:00 +0000 CVE-2023-22518 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-46604 Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Vendor: Apache Product: ActiveMQ Added to CISA KEV: 2023-11-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-23 Known ransomware use: Known Thu, 02 Nov 2023 00:00:00 +0000 CVE-2023-46604 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-46748 F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. Vendor: F5 Product: BIG-IP Configuration Utility Added to CISA KEV: 2023-10-31 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-21 Known ransomware use: Unknown Tue, 31 Oct 2023 00:00:00 +0000 CVE-2023-46748 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-46747 F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. Vendor: F5 Product: BIG-IP Configuration Utility Added to CISA KEV: 2023-10-31 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-21 Known ransomware use: Known Tue, 31 Oct 2023 00:00:00 +0000 CVE-2023-46747 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-5631 Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. Vendor: Roundcube Product: Webmail Added to CISA KEV: 2023-10-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-16 Known ransomware use: Unknown Thu, 26 Oct 2023 00:00:00 +0000 CVE-2023-5631 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20273 Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity. Vendor: Cisco Product: Cisco IOS XE Web UI Added to CISA KEV: 2023-10-23 CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. Federal due date: 2023-10-27 Known ransomware use: Unknown Mon, 23 Oct 2023 00:00:00 +0000 CVE-2023-20273 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4966 Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Vendor: Citrix Product: NetScaler ADC and NetScaler Gateway Added to CISA KEV: 2023-10-18 CISA required action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable. Federal due date: 2023-11-08 Known ransomware use: Known Wed, 18 Oct 2023 00:00:00 +0000 CVE-2023-4966 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20198 Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device. Vendor: Cisco Product: IOS XE Web UI Added to CISA KEV: 2023-10-16 CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. Federal due date: 2023-10-20 Known ransomware use: Unknown Mon, 16 Oct 2023 00:00:00 +0000 CVE-2023-20198 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21608 Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2023-10-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-31 Known ransomware use: Unknown Tue, 10 Oct 2023 00:00:00 +0000 CVE-2023-21608 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20109 Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. Vendor: Cisco Product: IOS and IOS XE Added to CISA KEV: 2023-10-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-31 Known ransomware use: Unknown Tue, 10 Oct 2023 00:00:00 +0000 CVE-2023-20109 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41763 Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Skype for Business Added to CISA KEV: 2023-10-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-31 Known ransomware use: Unknown Tue, 10 Oct 2023 00:00:00 +0000 CVE-2023-41763 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36563 Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure. Vendor: Microsoft Product: WordPad Added to CISA KEV: 2023-10-10 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-31 Known ransomware use: Unknown Tue, 10 Oct 2023 00:00:00 +0000 CVE-2023-36563 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-44487 HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). Vendor: IETF Product: HTTP/2 Added to CISA KEV: 2023-10-10 CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-31 Known ransomware use: Unknown Tue, 10 Oct 2023 00:00:00 +0000 CVE-2023-44487 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-22515 Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. Vendor: Atlassian Product: Confluence Data Center and Server Added to CISA KEV: 2023-10-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA. Federal due date: 2023-10-13 Known ransomware use: Known Thu, 05 Oct 2023 00:00:00 +0000 CVE-2023-22515 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-40044 Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Vendor: Progress Product: WS_FTP Server Added to CISA KEV: 2023-10-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-26 Known ransomware use: Known Thu, 05 Oct 2023 00:00:00 +0000 CVE-2023-40044 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-42824 Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Vendor: Apple Product: iOS and iPadOS Added to CISA KEV: 2023-10-05 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-26 Known ransomware use: Unknown Thu, 05 Oct 2023 00:00:00 +0000 CVE-2023-42824 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-42793 JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server. Vendor: JetBrains Product: TeamCity Added to CISA KEV: 2023-10-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-25 Known ransomware use: Known Wed, 04 Oct 2023 00:00:00 +0000 CVE-2023-42793 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28229 Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Vendor: Microsoft Product: Windows CNG Key Isolation Service Added to CISA KEV: 2023-10-04 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-25 Known ransomware use: Unknown Wed, 04 Oct 2023 00:00:00 +0000 CVE-2023-28229 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4211 Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. Vendor: Arm Product: Mali GPU Kernel Driver Added to CISA KEV: 2023-10-03 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-24 Known ransomware use: Unknown Tue, 03 Oct 2023 00:00:00 +0000 CVE-2023-4211 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-5217 Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome. Vendor: Google Product: Chromium libvpx Added to CISA KEV: 2023-10-02 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-23 Known ransomware use: Unknown Mon, 02 Oct 2023 00:00:00 +0000 CVE-2023-5217 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14667 Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData. Vendor: Red Hat Product: JBoss RichFaces Framework Added to CISA KEV: 2023-09-28 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-19 Known ransomware use: Unknown Thu, 28 Sep 2023 00:00:00 +0000 CVE-2018-14667 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41991 Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-09-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-16 Known ransomware use: Unknown Mon, 25 Sep 2023 00:00:00 +0000 CVE-2023-41991 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41992 Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-09-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-16 Known ransomware use: Unknown Mon, 25 Sep 2023 00:00:00 +0000 CVE-2023-41992 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41993 Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-09-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-16 Known ransomware use: Unknown Mon, 25 Sep 2023 00:00:00 +0000 CVE-2023-41993 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41179 Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability. Vendor: Trend Micro Product: Apex One and Worry-Free Business Security Added to CISA KEV: 2023-09-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-12 Known ransomware use: Unknown Thu, 21 Sep 2023 00:00:00 +0000 CVE-2023-41179 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28434 MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. Vendor: MinIO Product: MinIO Added to CISA KEV: 2023-09-19 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-10 Known ransomware use: Unknown Tue, 19 Sep 2023 00:00:00 +0000 CVE-2023-28434 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22265 Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-09 Known ransomware use: Unknown Mon, 18 Sep 2023 00:00:00 +0000 CVE-2022-22265 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-8361 Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request. Vendor: Realtek Product: SDK Added to CISA KEV: 2023-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-09 Known ransomware use: Unknown Mon, 18 Sep 2023 00:00:00 +0000 CVE-2014-8361 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6884 Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. Vendor: Zyxel Product: EMG2926 Routers Added to CISA KEV: 2023-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-09 Known ransomware use: Known Mon, 18 Sep 2023 00:00:00 +0000 CVE-2017-6884 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-3129 Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents(). Vendor: Laravel Product: Ignition Added to CISA KEV: 2023-09-18 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-09 Known ransomware use: Known Mon, 18 Sep 2023 00:00:00 +0000 CVE-2021-3129 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-26369 Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2023-09-14 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-05 Known ransomware use: Unknown Thu, 14 Sep 2023 00:00:00 +0000 CVE-2023-26369 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-35674 Android Framework contains an unspecified vulnerability that allows for privilege escalation. Vendor: Android Product: Framework Added to CISA KEV: 2023-09-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-04 Known ransomware use: Unknown Wed, 13 Sep 2023 00:00:00 +0000 CVE-2023-35674 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20269 Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. Vendor: Cisco Product: Adaptive Security Appliance and Firepower Threat Defense Added to CISA KEV: 2023-09-13 CISA required action: Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices. Federal due date: 2023-10-04 Known ransomware use: Known Wed, 13 Sep 2023 00:00:00 +0000 CVE-2023-20269 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec. Vendor: Google Product: Chromium WebP Added to CISA KEV: 2023-09-13 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-04 Known ransomware use: Unknown Wed, 13 Sep 2023 00:00:00 +0000 CVE-2023-4863 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36761 Microsoft Word contains an unspecified vulnerability that allows for information disclosure. Vendor: Microsoft Product: Word Added to CISA KEV: 2023-09-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-03 Known ransomware use: Unknown Tue, 12 Sep 2023 00:00:00 +0000 CVE-2023-36761 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36802 Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Streaming Service Proxy Added to CISA KEV: 2023-09-12 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-03 Known ransomware use: Unknown Tue, 12 Sep 2023 00:00:00 +0000 CVE-2023-36802 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41064 Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2023-09-11 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-02 Known ransomware use: Unknown Mon, 11 Sep 2023 00:00:00 +0000 CVE-2023-41064 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-41061 Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064. Vendor: Apple Product: iOS, iPadOS, and watchOS Added to CISA KEV: 2023-09-11 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-10-02 Known ransomware use: Unknown Mon, 11 Sep 2023 00:00:00 +0000 CVE-2023-41061 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33246 Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. Vendor: Apache Product: RocketMQ Added to CISA KEV: 2023-09-06 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-27 Known ransomware use: Unknown Wed, 06 Sep 2023 00:00:00 +0000 CVE-2023-33246 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38831 RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive. Vendor: RARLAB Product: WinRAR Added to CISA KEV: 2023-08-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-14 Known ransomware use: Known Thu, 24 Aug 2023 00:00:00 +0000 CVE-2023-38831 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32315 Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users. Vendor: Ignite Realtime Product: Openfire Added to CISA KEV: 2023-08-24 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-14 Known ransomware use: Unknown Thu, 24 Aug 2023 00:00:00 +0000 CVE-2023-32315 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38035 Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Vendor: Ivanti Product: Sentry Added to CISA KEV: 2023-08-22 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-12 Known ransomware use: Known Tue, 22 Aug 2023 00:00:00 +0000 CVE-2023-38035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27532 Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. Vendor: Veeam Product: Backup & Replication Added to CISA KEV: 2023-08-22 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-12 Known ransomware use: Known Tue, 22 Aug 2023 00:00:00 +0000 CVE-2023-27532 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-26359 Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2023-08-21 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-11 Known ransomware use: Unknown Mon, 21 Aug 2023 00:00:00 +0000 CVE-2023-26359 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-24489 Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers. Vendor: Citrix Product: Content Collaboration Added to CISA KEV: 2023-08-16 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-09-06 Known ransomware use: Unknown Wed, 16 Aug 2023 00:00:00 +0000 CVE-2023-24489 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38180 Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). Vendor: Microsoft Product: .NET Core and Visual Studio Added to CISA KEV: 2023-08-09 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-30 Known ransomware use: Unknown Wed, 09 Aug 2023 00:00:00 +0000 CVE-2023-38180 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-18368 Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page. Vendor: Zyxel Product: P660HN-T1A Routers Added to CISA KEV: 2023-08-07 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-28 Known ransomware use: Unknown Mon, 07 Aug 2023 00:00:00 +0000 CVE-2017-18368 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable). Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2023-07-31 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-21 Known ransomware use: Unknown Mon, 31 Jul 2023 00:00:00 +0000 CVE-2023-35081 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-37580 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2023-07-27 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-17 Known ransomware use: Unknown Thu, 27 Jul 2023 00:00:00 +0000 CVE-2023-37580 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38606 Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-07-26 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-16 Known ransomware use: Unknown Wed, 26 Jul 2023 00:00:00 +0000 CVE-2023-38606 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-35078 Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Added to CISA KEV: 2023-07-25 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-15 Known ransomware use: Known Tue, 25 Jul 2023 00:00:00 +0000 CVE-2023-35078 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29298 Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2023-07-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-10 Known ransomware use: Unknown Thu, 20 Jul 2023 00:00:00 +0000 CVE-2023-29298 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-38205 Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2023-07-20 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-10 Known ransomware use: Unknown Thu, 20 Jul 2023 00:00:00 +0000 CVE-2023-38205 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-3519 Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. Vendor: Citrix Product: NetScaler ADC and NetScaler Gateway Added to CISA KEV: 2023-07-19 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-09 Known ransomware use: Known Wed, 19 Jul 2023 00:00:00 +0000 CVE-2023-3519 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36884 Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-07-17 CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal due date: 2023-08-29 Known ransomware use: Known Mon, 17 Jul 2023 00:00:00 +0000 CVE-2023-36884 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-29303 SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server. Vendor: SolarView Product: Compact Added to CISA KEV: 2023-07-13 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-03 Known ransomware use: Unknown Thu, 13 Jul 2023 00:00:00 +0000 CVE-2022-29303 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-37450 Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-07-13 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-03 Known ransomware use: Unknown Thu, 13 Jul 2023 00:00:00 +0000 CVE-2023-37450 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32046 Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-07-11 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-01 Known ransomware use: Unknown Tue, 11 Jul 2023 00:00:00 +0000 CVE-2023-32046 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32049 Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-07-11 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-01 Known ransomware use: Unknown Tue, 11 Jul 2023 00:00:00 +0000 CVE-2023-32049 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-35311 Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. Vendor: Microsoft Product: Outlook Added to CISA KEV: 2023-07-11 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-01 Known ransomware use: Unknown Tue, 11 Jul 2023 00:00:00 +0000 CVE-2023-35311 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-36874 Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-07-11 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-01 Known ransomware use: Unknown Tue, 11 Jul 2023 00:00:00 +0000 CVE-2023-36874 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-31199 Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Vendor: Netwrix Product: Auditor Added to CISA KEV: 2023-07-11 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-08-01 Known ransomware use: Known Tue, 11 Jul 2023 00:00:00 +0000 CVE-2022-31199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-29256 Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2023-07-07 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-07-28 Known ransomware use: Unknown Fri, 07 Jul 2023 00:00:00 +0000 CVE-2021-29256 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-17621 D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Vendor: D-Link Product: DIR-859 Router Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2019-17621 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-20500 D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter. Vendor: D-Link Product: DWL-2600AP Access Point Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2019-20500 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25487 Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25487 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25489 Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25489 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25394 Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25394 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25395 Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25395 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25371 Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25371 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25372 Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-06-29 CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal due date: 2023-07-20 Known ransomware use: Unknown Thu, 29 Jun 2023 00:00:00 +0000 CVE-2021-25372 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32434 Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-06-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-14 Known ransomware use: Unknown Fri, 23 Jun 2023 00:00:00 +0000 CVE-2023-32434 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32435 Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-06-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-14 Known ransomware use: Unknown Fri, 23 Jun 2023 00:00:00 +0000 CVE-2023-32435 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32439 Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-06-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-14 Known ransomware use: Unknown Fri, 23 Jun 2023 00:00:00 +0000 CVE-2023-32439 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20867 VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. Vendor: VMware Product: Tools Added to CISA KEV: 2023-06-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-14 Known ransomware use: Unknown Fri, 23 Jun 2023 00:00:00 +0000 CVE-2023-20867 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27992 Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. Vendor: Zyxel Product: Multiple Network-Attached Storage (NAS) Devices Added to CISA KEV: 2023-06-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-14 Known ransomware use: Unknown Fri, 23 Jun 2023 00:00:00 +0000 CVE-2023-27992 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20887 VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. Vendor: VMware Product: Aria Operations for Networks Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2023-20887 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-35730 Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. Vendor: Roundcube Product: Roundcube Webmail Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2020-35730 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-12641 Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. Vendor: Roundcube Product: Roundcube Webmail Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2020-12641 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44026 Roundcube Webmail is vulnerable to SQL injection via search or search_params. Vendor: Roundcube Product: Roundcube Webmail Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2021-44026 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-9079 Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows. Vendor: Mozilla Product: Firefox, Firefox ESR, and Thunderbird Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2016-9079 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0165 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2023-06-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-13 Known ransomware use: Unknown Thu, 22 Jun 2023 00:00:00 +0000 CVE-2016-0165 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27997 Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. Vendor: Fortinet Product: FortiOS and FortiProxy SSL-VPN Added to CISA KEV: 2023-06-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-07-04 Known ransomware use: Known Tue, 13 Jun 2023 00:00:00 +0000 CVE-2023-27997 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-3079 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2023-06-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-28 Known ransomware use: Unknown Wed, 07 Jun 2023 00:00:00 +0000 CVE-2023-3079 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33009 Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Vendor: Zyxel Product: Multiple Firewalls Added to CISA KEV: 2023-06-05 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-26 Known ransomware use: Unknown Mon, 05 Jun 2023 00:00:00 +0000 CVE-2023-33009 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-33010 Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Vendor: Zyxel Product: Multiple Firewalls Added to CISA KEV: 2023-06-05 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-26 Known ransomware use: Unknown Mon, 05 Jun 2023 00:00:00 +0000 CVE-2023-33010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-34362 Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. Vendor: Progress Product: MOVEit Transfer Added to CISA KEV: 2023-06-02 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-23 Known ransomware use: Known Fri, 02 Jun 2023 00:00:00 +0000 CVE-2023-34362 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28771 Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. Vendor: Zyxel Product: Multiple Firewalls Added to CISA KEV: 2023-05-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-21 Known ransomware use: Unknown Wed, 31 May 2023 00:00:00 +0000 CVE-2023-28771 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-2868 Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. Vendor: Barracuda Networks Product: Email Security Gateway (ESG) Appliance Added to CISA KEV: 2023-05-26 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-16 Known ransomware use: Unknown Fri, 26 May 2023 00:00:00 +0000 CVE-2023-2868 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32409 Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-05-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-12 Known ransomware use: Unknown Mon, 22 May 2023 00:00:00 +0000 CVE-2023-32409 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28204 Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-05-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-12 Known ransomware use: Unknown Mon, 22 May 2023 00:00:00 +0000 CVE-2023-28204 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-32373 Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-05-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-12 Known ransomware use: Unknown Mon, 22 May 2023 00:00:00 +0000 CVE-2023-32373 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2004-1464 Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device. Vendor: Cisco Product: IOS Added to CISA KEV: 2023-05-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-09 Known ransomware use: Unknown Fri, 19 May 2023 00:00:00 +0000 CVE-2004-1464 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-6415 Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure. Vendor: Cisco Product: IOS, IOS XR, and IOS XE Added to CISA KEV: 2023-05-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-09 Known ransomware use: Unknown Fri, 19 May 2023 00:00:00 +0000 CVE-2016-6415 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21492 Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2023-05-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-09 Known ransomware use: Unknown Fri, 19 May 2023 00:00:00 +0000 CVE-2023-21492 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-25717 Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs. Vendor: Ruckus Wireless Product: Multiple Products Added to CISA KEV: 2023-05-12 CISA required action: Apply updates per vendor instructions or disconnect product if it is end-of-life. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2023-25717 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-3560 Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. Vendor: Red Hat Product: Polkit Added to CISA KEV: 2023-05-12 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2021-3560 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0196 Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings. Vendor: Linux Product: Kernel Added to CISA KEV: 2023-05-12 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2014-0196 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-3904 Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. Vendor: Linux Product: Kernel Added to CISA KEV: 2023-05-12 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2010-3904 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5317 Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages. Vendor: Jenkins Product: Jenkins User Interface (UI) Added to CISA KEV: 2023-05-12 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2015-5317 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3427 Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. Vendor: Oracle Product: Java SE and JRockit Added to CISA KEV: 2023-05-12 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2016-3427 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-8735 Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types. Vendor: Apache Product: Tomcat Added to CISA KEV: 2023-05-12 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-06-02 Known ransomware use: Unknown Fri, 12 May 2023 00:00:00 +0000 CVE-2016-8735 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29336 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2023-05-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-30 Known ransomware use: Unknown Tue, 09 May 2023 00:00:00 +0000 CVE-2023-29336 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-1389 TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. Vendor: TP-Link Product: Archer AX21 Added to CISA KEV: 2023-05-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-22 Known ransomware use: Unknown Mon, 01 May 2023 00:00:00 +0000 CVE-2023-1389 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-45046 Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. Vendor: Apache Product: Log4j2 Added to CISA KEV: 2023-05-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-22 Known ransomware use: Known Mon, 01 May 2023 00:00:00 +0000 CVE-2021-45046 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21839 Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2023-05-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-22 Known ransomware use: Unknown Mon, 01 May 2023 00:00:00 +0000 CVE-2023-21839 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28432 MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure. Vendor: MinIO Product: MinIO Added to CISA KEV: 2023-04-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-12 Known ransomware use: Unknown Fri, 21 Apr 2023 00:00:00 +0000 CVE-2023-28432 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-27350 PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. Vendor: PaperCut Product: MF/NG Added to CISA KEV: 2023-04-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-12 Known ransomware use: Known Fri, 21 Apr 2023 00:00:00 +0000 CVE-2023-27350 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-2136 Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Vendor: Google Product: Chromium Skia Added to CISA KEV: 2023-04-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-12 Known ransomware use: Unknown Fri, 21 Apr 2023 00:00:00 +0000 CVE-2023-2136 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6742 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2023-04-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-10 Known ransomware use: Unknown Wed, 19 Apr 2023 00:00:00 +0000 CVE-2017-6742 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-8526 Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. Vendor: Apple Product: macOS Added to CISA KEV: 2023-04-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-08 Known ransomware use: Unknown Mon, 17 Apr 2023 00:00:00 +0000 CVE-2019-8526 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-2033 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2023-04-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-08 Known ransomware use: Unknown Mon, 17 Apr 2023 00:00:00 +0000 CVE-2023-2033 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-20963 Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. Vendor: Android Product: Framework Added to CISA KEV: 2023-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-04 Known ransomware use: Unknown Thu, 13 Apr 2023 00:00:00 +0000 CVE-2023-20963 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-29492 Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. Vendor: Novi Survey Product: Novi Survey Added to CISA KEV: 2023-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-04 Known ransomware use: Unknown Thu, 13 Apr 2023 00:00:00 +0000 CVE-2023-29492 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28252 Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-02 Known ransomware use: Known Tue, 11 Apr 2023 00:00:00 +0000 CVE-2023-28252 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28205 Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-04-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-01 Known ransomware use: Unknown Mon, 10 Apr 2023 00:00:00 +0000 CVE-2023-28205 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-28206 Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2023-04-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-05-01 Known ransomware use: Unknown Mon, 10 Apr 2023 00:00:00 +0000 CVE-2023-28206 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27876 Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine. Vendor: Veritas Product: Backup Exec Agent Added to CISA KEV: 2023-04-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-28 Known ransomware use: Known Fri, 07 Apr 2023 00:00:00 +0000 CVE-2021-27876 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27877 Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme. Vendor: Veritas Product: Backup Exec Agent Added to CISA KEV: 2023-04-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-28 Known ransomware use: Known Fri, 07 Apr 2023 00:00:00 +0000 CVE-2021-27877 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27878 Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine. Vendor: Veritas Product: Backup Exec Agent Added to CISA KEV: 2023-04-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-28 Known ransomware use: Known Fri, 07 Apr 2023 00:00:00 +0000 CVE-2021-27878 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1388 Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-04-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-28 Known ransomware use: Known Fri, 07 Apr 2023 00:00:00 +0000 CVE-2019-1388 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-26083 Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2023-04-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-28 Known ransomware use: Unknown Fri, 07 Apr 2023 00:00:00 +0000 CVE-2023-26083 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-27926 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2023-04-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-24 Known ransomware use: Unknown Mon, 03 Apr 2023 00:00:00 +0000 CVE-2022-27926 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3163 Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2023-03-30 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2013-3163 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-7494 Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it. Vendor: Samba Product: Samba Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Known Thu, 30 Mar 2023 00:00:00 +0000 CVE-2017-7494 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-42948 Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Vendor: Fortra Product: Cobalt Strike Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2022-42948 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-39197 Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Vendor: Fortra Product: Cobalt Strike Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2022-39197 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30900 Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2021-30900 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-38181 Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2022-38181 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-0266 Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. Vendor: Linux Product: Kernel Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2023-0266 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-3038 Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Network Service Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2022-3038 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22706 Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2023-03-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-20 Known ransomware use: Unknown Thu, 30 Mar 2023 00:00:00 +0000 CVE-2022-22706 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-26360 Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2023-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-05 Known ransomware use: Unknown Wed, 15 Mar 2023 00:00:00 +0000 CVE-2023-26360 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-23397 Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. Vendor: Microsoft Product: Office Added to CISA KEV: 2023-03-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-04 Known ransomware use: Unknown Tue, 14 Mar 2023 00:00:00 +0000 CVE-2023-23397 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-24880 Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-03-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-04 Known ransomware use: Known Tue, 14 Mar 2023 00:00:00 +0000 CVE-2023-24880 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41328 Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2023-03-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-04-04 Known ransomware use: Unknown Tue, 14 Mar 2023 00:00:00 +0000 CVE-2022-41328 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-39144 XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation. Vendor: XStream Product: XStream Added to CISA KEV: 2023-03-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-31 Known ransomware use: Unknown Fri, 10 Mar 2023 00:00:00 +0000 CVE-2021-39144 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5741 Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it. Vendor: Plex Product: Media Server Added to CISA KEV: 2023-03-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-31 Known ransomware use: Unknown Fri, 10 Mar 2023 00:00:00 +0000 CVE-2020-5741 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-28810 Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2023-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-28 Known ransomware use: Unknown Tue, 07 Mar 2023 00:00:00 +0000 CVE-2022-28810 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-33891 Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Vendor: Apache Product: Spark Added to CISA KEV: 2023-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-28 Known ransomware use: Unknown Tue, 07 Mar 2023 00:00:00 +0000 CVE-2022-33891 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-35914 Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. Vendor: Teclib Product: GLPI Added to CISA KEV: 2023-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-28 Known ransomware use: Unknown Tue, 07 Mar 2023 00:00:00 +0000 CVE-2022-35914 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-36537 ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Vendor: ZK Framework Product: AuUploader Added to CISA KEV: 2023-02-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-20 Known ransomware use: Known Mon, 27 Feb 2023 00:00:00 +0000 CVE-2022-36537 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-47986 IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. Vendor: IBM Product: Aspera Faspex Added to CISA KEV: 2023-02-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-14 Known ransomware use: Known Tue, 21 Feb 2023 00:00:00 +0000 CVE-2022-47986 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41223 The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. Vendor: Mitel Product: MiVoice Connect Added to CISA KEV: 2023-02-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-14 Known ransomware use: Known Tue, 21 Feb 2023 00:00:00 +0000 CVE-2022-41223 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-40765 The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. Vendor: Mitel Product: MiVoice Connect Added to CISA KEV: 2023-02-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-14 Known ransomware use: Known Tue, 21 Feb 2023 00:00:00 +0000 CVE-2022-40765 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-46169 Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. Vendor: Cacti Product: Cacti Added to CISA KEV: 2023-02-16 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-09 Known ransomware use: Unknown Thu, 16 Feb 2023 00:00:00 +0000 CVE-2022-46169 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21715 Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system. Vendor: Microsoft Product: Office Added to CISA KEV: 2023-02-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-07 Known ransomware use: Unknown Tue, 14 Feb 2023 00:00:00 +0000 CVE-2023-21715 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-23376 Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-02-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-07 Known ransomware use: Known Tue, 14 Feb 2023 00:00:00 +0000 CVE-2023-23376 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-23529 Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2023-02-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-07 Known ransomware use: Unknown Tue, 14 Feb 2023 00:00:00 +0000 CVE-2023-23529 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21823 Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-02-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-07 Known ransomware use: Unknown Tue, 14 Feb 2023 00:00:00 +0000 CVE-2023-21823 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2291 Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS). Vendor: Intel Product: Ethernet Diagnostics Driver for Windows Added to CISA KEV: 2023-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-03 Known ransomware use: Known Fri, 10 Feb 2023 00:00:00 +0000 CVE-2015-2291 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24990 TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. Vendor: TerraMaster Product: TerraMaster OS Added to CISA KEV: 2023-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-03 Known ransomware use: Known Fri, 10 Feb 2023 00:00:00 +0000 CVE-2022-24990 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-0669 Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object. Vendor: Fortra Product: GoAnywhere MFT Added to CISA KEV: 2023-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-03-03 Known ransomware use: Known Fri, 10 Feb 2023 00:00:00 +0000 CVE-2023-0669 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21587 Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Vendor: Oracle Product: E-Business Suite Added to CISA KEV: 2023-02-02 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-02-23 Known ransomware use: Known Thu, 02 Feb 2023 00:00:00 +0000 CVE-2022-21587 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-22952 Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates. Vendor: SugarCRM Product: Multiple Products Added to CISA KEV: 2023-02-02 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-02-23 Known ransomware use: Unknown Thu, 02 Feb 2023 00:00:00 +0000 CVE-2023-22952 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11357 Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution. Vendor: Telerik Product: User Interface (UI) for ASP.NET AJAX Added to CISA KEV: 2023-01-26 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-02-16 Known ransomware use: Known Thu, 26 Jan 2023 00:00:00 +0000 CVE-2017-11357 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-47966 Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2023-01-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-02-13 Known ransomware use: Known Mon, 23 Jan 2023 00:00:00 +0000 CVE-2022-47966 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-44877 CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. Vendor: CWP Product: Control Web Panel Added to CISA KEV: 2023-01-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-02-07 Known ransomware use: Unknown Tue, 17 Jan 2023 00:00:00 +0000 CVE-2022-44877 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41080 Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2023-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-31 Known ransomware use: Known Tue, 10 Jan 2023 00:00:00 +0000 CVE-2022-41080 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2023-21674 Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2023-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-31 Known ransomware use: Unknown Tue, 10 Jan 2023 00:00:00 +0000 CVE-2023-21674 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-5430 TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Vendor: TIBCO Product: JasperReports Added to CISA KEV: 2022-12-29 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-19 Known ransomware use: Unknown Thu, 29 Dec 2022 00:00:00 +0000 CVE-2018-5430 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-18809 TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system. Vendor: TIBCO Product: JasperReports Added to CISA KEV: 2022-12-29 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-19 Known ransomware use: Unknown Thu, 29 Dec 2022 00:00:00 +0000 CVE-2018-18809 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-42856 Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution. Vendor: Apple Product: iOS Added to CISA KEV: 2022-12-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-04 Known ransomware use: Unknown Wed, 14 Dec 2022 00:00:00 +0000 CVE-2022-42856 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-42475 Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2022-12-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-03 Known ransomware use: Known Tue, 13 Dec 2022 00:00:00 +0000 CVE-2022-42475 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-44698 Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Vendor: Microsoft Product: Defender Added to CISA KEV: 2022-12-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-03 Known ransomware use: Known Tue, 13 Dec 2022 00:00:00 +0000 CVE-2022-44698 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-27518 Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. Vendor: Citrix Product: Application Delivery Controller (ADC) and Gateway Added to CISA KEV: 2022-12-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-03 Known ransomware use: Unknown Tue, 13 Dec 2022 00:00:00 +0000 CVE-2022-27518 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26500 The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. Vendor: Veeam Product: Backup & Replication Added to CISA KEV: 2022-12-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-03 Known ransomware use: Known Tue, 13 Dec 2022 00:00:00 +0000 CVE-2022-26500 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26501 The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. Vendor: Veeam Product: Backup & Replication Added to CISA KEV: 2022-12-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2023-01-03 Known ransomware use: Known Tue, 13 Dec 2022 00:00:00 +0000 CVE-2022-26501 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-4262 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-12-05 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-26 Known ransomware use: Unknown Mon, 05 Dec 2022 00:00:00 +0000 CVE-2022-4262 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35587 Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2022-11-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-19 Known ransomware use: Unknown Mon, 28 Nov 2022 00:00:00 +0000 CVE-2021-35587 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-4135 Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium GPU Added to CISA KEV: 2022-11-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-19 Known ransomware use: Unknown Mon, 28 Nov 2022 00:00:00 +0000 CVE-2022-4135 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41049 Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-11-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-09 Known ransomware use: Unknown Mon, 14 Nov 2022 00:00:00 +0000 CVE-2022-41049 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41091 Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-09 Known ransomware use: Known Tue, 08 Nov 2022 00:00:00 +0000 CVE-2022-41091 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41073 Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-09 Known ransomware use: Known Tue, 08 Nov 2022 00:00:00 +0000 CVE-2022-41073 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41125 Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-09 Known ransomware use: Unknown Tue, 08 Nov 2022 00:00:00 +0000 CVE-2022-41125 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41128 Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-12-09 Known ransomware use: Unknown Tue, 08 Nov 2022 00:00:00 +0000 CVE-2022-41128 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25337 Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-29 Known ransomware use: Unknown Tue, 08 Nov 2022 00:00:00 +0000 CVE-2021-25337 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25369 Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-29 Known ransomware use: Unknown Tue, 08 Nov 2022 00:00:00 +0000 CVE-2021-25369 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25370 Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. Vendor: Samsung Product: Mobile Devices Added to CISA KEV: 2022-11-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-29 Known ransomware use: Unknown Tue, 08 Nov 2022 00:00:00 +0000 CVE-2021-25370 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-3723 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-10-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-18 Known ransomware use: Unknown Fri, 28 Oct 2022 00:00:00 +0000 CVE-2022-3723 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-42827 Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges. Vendor: Apple Product: iOS and iPadOS Added to CISA KEV: 2022-10-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-15 Known ransomware use: Unknown Tue, 25 Oct 2022 00:00:00 +0000 CVE-2022-42827 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3433 Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges. Vendor: Cisco Product: AnyConnect Secure Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2020-3433 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. Vendor: Cisco Product: AnyConnect Secure Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2020-3153 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19323 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. Vendor: GIGABYTE Product: Multiple Products Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2018-19323 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19322 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges. Vendor: GIGABYTE Product: Multiple Products Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2018-19322 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19321 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. Vendor: GIGABYTE Product: Multiple Products Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2018-19321 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19320 The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system. Vendor: GIGABYTE Product: Multiple Products Added to CISA KEV: 2022-10-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-14 Known ransomware use: Known Mon, 24 Oct 2022 00:00:00 +0000 CVE-2018-19320 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-10-20 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-10 Known ransomware use: Known Thu, 20 Oct 2022 00:00:00 +0000 CVE-2022-41352 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-3493 The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-10-20 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-10 Known ransomware use: Unknown Thu, 20 Oct 2022 00:00:00 +0000 CVE-2021-3493 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-40684 Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. Vendor: Fortinet Product: Multiple Products Added to CISA KEV: 2022-10-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-01 Known ransomware use: Known Tue, 11 Oct 2022 00:00:00 +0000 CVE-2022-40684 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41033 Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows COM+ Event System Service Added to CISA KEV: 2022-10-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-11-01 Known ransomware use: Unknown Tue, 11 Oct 2022 00:00:00 +0000 CVE-2022-41033 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41082 Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2022-09-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-21 Known ransomware use: Known Fri, 30 Sep 2022 00:00:00 +0000 CVE-2022-41082 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-41040 Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2022-09-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-21 Known ransomware use: Known Fri, 30 Sep 2022 00:00:00 +0000 CVE-2022-41040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-36804 Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request. Vendor: Atlassian Product: Bitbucket Server and Data Center Added to CISA KEV: 2022-09-30 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-21 Known ransomware use: Unknown Fri, 30 Sep 2022 00:00:00 +0000 CVE-2022-36804 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-3236 A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. Vendor: Sophos Product: Firewall Added to CISA KEV: 2022-09-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-14 Known ransomware use: Unknown Fri, 23 Sep 2022 00:00:00 +0000 CVE-2022-3236 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-35405 Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2022-09-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-13 Known ransomware use: Unknown Thu, 22 Sep 2022 00:00:00 +0000 CVE-2022-35405 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-40139 Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution. Vendor: Trend Micro Product: Apex One and Apex One as a Service Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2022-40139 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-6282 The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2013-6282 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2597 The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android. Vendor: Code Aurora Product: ACDB Audio Driver Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2013-2597 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2596 Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2013-2596 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2094 Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2013-2094 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-2568 Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-09-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-06 Known ransomware use: Unknown Thu, 15 Sep 2022 00:00:00 +0000 CVE-2010-2568 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-37969 Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-09-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-05 Known ransomware use: Known Wed, 14 Sep 2022 00:00:00 +0000 CVE-2022-37969 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-32917 Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2022-09-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-10-05 Known ransomware use: Unknown Wed, 14 Sep 2022 00:00:00 +0000 CVE-2022-32917 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-3075 Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Mojo Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2022-3075 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-27593 Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign. Vendor: QNAP Product: Photo Station Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Known Thu, 08 Sep 2022 00:00:00 +0000 CVE-2022-27593 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26258 D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. Vendor: D-Link Product: DIR-820L Added to CISA KEV: 2022-09-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2022-26258 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9934 Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2020-9934 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-7445 In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. Vendor: MikroTik Product: RouterOS Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2018-7445 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-6530 Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands. Vendor: D-Link Product: Multiple Routers Added to CISA KEV: 2022-09-08 CISA required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use. Federal due date: 2022-09-29 Known ransomware use: Known Thu, 08 Sep 2022 00:00:00 +0000 CVE-2018-6530 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-2628 Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2018-2628 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-13374 Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server. Vendor: Fortinet Product: FortiOS and FortiADC Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Known Thu, 08 Sep 2022 00:00:00 +0000 CVE-2018-13374 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-5521 Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server. Vendor: NETGEAR Product: Multiple Devices Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2017-5521 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-4723 The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information. Vendor: D-Link Product: DIR-300 Router Added to CISA KEV: 2022-09-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2011-4723 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-1823 The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor. Vendor: Android Product: Android OS Added to CISA KEV: 2022-09-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-29 Known ransomware use: Unknown Thu, 08 Sep 2022 00:00:00 +0000 CVE-2011-1823 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26352 dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution. Vendor: dotCMS Product: dotCMS Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Known Thu, 25 Aug 2022 00:00:00 +0000 CVE-2022-26352 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24706 Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges. Vendor: Apache Product: CouchDB Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2022-24706 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24112 Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. Vendor: Apache Product: APISIX Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2022-24112 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22963 When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. Vendor: VMware Tanzu Product: Spring Cloud Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2022-22963 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-2294 WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome. Vendor: WebRTC Product: WebRTC Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Known Thu, 25 Aug 2022 00:00:00 +0000 CVE-2022-2294 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-39226 Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. Vendor: Grafana Labs Product: Grafana Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2021-39226 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38406 Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution. Vendor: Delta Electronics Product: DOPSoft 2 Added to CISA KEV: 2022-08-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2021-38406 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31010 In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions. Vendor: Apple Product: iOS, macOS, watchOS Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2021-31010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-36193 PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. Vendor: PEAR Product: Archive_Tar Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2020-36193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-28949 PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. Vendor: PEAR Product: Archive_Tar Added to CISA KEV: 2022-08-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-15 Known ransomware use: Unknown Thu, 25 Aug 2022 00:00:00 +0000 CVE-2020-28949 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0028 A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2022-08-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-12 Known ransomware use: Unknown Mon, 22 Aug 2022 00:00:00 +0000 CVE-2022-0028 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22536 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. Vendor: SAP Product: Multiple Products Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-22536 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-32894 Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges. Vendor: Apple Product: iOS and macOS Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-32894 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-32893 Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content. Vendor: Apple Product: iOS and macOS Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-32893 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-2856 Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Intents Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-2856 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26923 An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. Vendor: Microsoft Product: Active Directory Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-26923 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21971 Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2022-21971 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-15944 Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2022-08-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-08 Known ransomware use: Unknown Thu, 18 Aug 2022 00:00:00 +0000 CVE-2017-15944 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-08-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-01 Known ransomware use: Known Thu, 11 Aug 2022 00:00:00 +0000 CVE-2022-27925 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-08-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-01 Known ransomware use: Known Thu, 11 Aug 2022 00:00:00 +0000 CVE-2022-37042 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-34713 A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-08-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-30 Known ransomware use: Unknown Tue, 09 Aug 2022 00:00:00 +0000 CVE-2022-34713 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-30333 RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation. Vendor: RARLAB Product: UnRAR Added to CISA KEV: 2022-08-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-30 Known ransomware use: Known Tue, 09 Aug 2022 00:00:00 +0000 CVE-2022-30333 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-08-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-25 Known ransomware use: Known Thu, 04 Aug 2022 00:00:00 +0000 CVE-2022-27924 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26138 Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. Vendor: Atlassian Product: Confluence Added to CISA KEV: 2022-07-29 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-19 Known ransomware use: Unknown Fri, 29 Jul 2022 00:00:00 +0000 CVE-2022-26138 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22047 Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-07-12 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-02 Known ransomware use: Unknown Tue, 12 Jul 2022 00:00:00 +0000 CVE-2022-22047 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26925 Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-07-01 CISA required action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch]. Federal due date: 2022-07-22 Known ransomware use: Unknown Fri, 01 Jul 2022 00:00:00 +0000 CVE-2022-26925 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-29499 The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. Vendor: Mitel Product: MiVoice Connect Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Known Mon, 27 Jun 2022 00:00:00 +0000 CVE-2022-29499 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30533 Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium PopupBlocker Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2021-30533 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-4034 The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights. Vendor: Red Hat Product: Polkit Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Known Mon, 27 Jun 2022 00:00:00 +0000 CVE-2021-4034 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30983 Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges. Vendor: Apple Product: iOS and iPadOS Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2021-30983 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3837 Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2020-3837 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9907 Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2020-9907 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-8605 A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2019-8605 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-4344 Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-06-27 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Mon, 27 Jun 2022 00:00:00 +0000 CVE-2018-4344 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-30190 A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-06-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-05 Known ransomware use: Known Tue, 14 Jun 2022 00:00:00 +0000 CVE-2022-30190 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38163 SAP NetWeaver contains a vulnerability that allows unrestricted file upload. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2022-06-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-30 Known ransomware use: Unknown Thu, 09 Jun 2022 00:00:00 +0000 CVE-2021-38163 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-2386 SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2022-06-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-30 Known ransomware use: Unknown Thu, 09 Jun 2022 00:00:00 +0000 CVE-2016-2386 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-2388 The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2022-06-09 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-30 Known ransomware use: Unknown Thu, 09 Jun 2022 00:00:00 +0000 CVE-2016-2388 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7195 QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. Vendor: QNAP Product: Photo Station Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Known Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-7195 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7194 QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. Vendor: QNAP Product: Photo Station Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Known Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-7194 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7193 QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system. Vendor: QNAP Product: QTS Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Known Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-7193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7192 QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system. Vendor: QNAP Product: Photo Station Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Known Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-7192 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-5825 Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-5825 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-15271 A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges. Vendor: Cisco Product: RV Series Routers Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2019-15271 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-6065 Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2018-6065 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-4990 Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2018-4990 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-17480 Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2018-17480 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-17463 Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2018-17463 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6862 Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution. Vendor: NETGEAR Product: Multiple Devices Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2017-6862 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-5070 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2017-5070 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-5030 Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2017-5030 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-5198 Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2016-5198 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-1646 Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2016-1646 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-1331 Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2013-1331 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-5054 Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-06-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-5054 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-4969 Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-4969 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1889 Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution. Vendor: Microsoft Product: XML Core Services Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-1889 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0767 Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-06-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-0767 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0754 Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-06-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-0754 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0151 The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2012-0151 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-2462 The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2011-2462 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-0609 Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-06-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2011-0609 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-2883 Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2010-2883 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-2572 Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution. Vendor: Microsoft Product: PowerPoint Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2010-2572 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-1297 Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-06-08 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2010-1297 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-4324 Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2009-4324 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-3953 Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2009-3953 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-1862 Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Adobe Product: Acrobat and Reader, Flash Player Added to CISA KEV: 2022-06-08 CISA required action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2009-1862 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-0563 Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2009-0563 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-0557 Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2009-0557 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-0655 Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2008-0655 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2007-5659 Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2007-5659 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2006-2492 Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code. Vendor: Microsoft Product: Word Added to CISA KEV: 2022-06-08 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-22 Known ransomware use: Unknown Wed, 08 Jun 2022 00:00:00 +0000 CVE-2006-2492 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26134 Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution. Vendor: Atlassian Product: Confluence Server/Data Center Added to CISA KEV: 2022-06-02 CISA required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules. Federal due date: 2022-06-06 Known ransomware use: Known Thu, 02 Jun 2022 00:00:00 +0000 CVE-2022-26134 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-3010 Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Oracle Product: Solaris Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2019-3010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3393 A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2016-3393 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7256 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2016-7256 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-1010 Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code. Vendor: Adobe Product: Flash Player and AIR Added to CISA KEV: 2022-05-25 CISA required action: The impacted products are end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2016-1010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0984 Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code. Vendor: Adobe Product: Flash Player and AIR Added to CISA KEV: 2022-05-25 CISA required action: The impacted products are end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2016-0984 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0034 Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS). Vendor: Microsoft Product: Silverlight Added to CISA KEV: 2022-05-25 CISA required action: The impacted products are end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2016-0034 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0310 Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-0310 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0016 Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-0016 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0071 Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-0071 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2360 Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS). Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-2360 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2425 Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-2425 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1769 A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-1769 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-4495 Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. Vendor: Mozilla Product: Firefox Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-4495 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-8651 Integer overflow in Adobe Flash Player allows attackers to execute code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-8651 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-6175 The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-6175 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1671 A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2015-1671 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4148 A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-4148 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-8439 Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-8439 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4123 Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-4123 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0546 Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-0546 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-2817 Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-2817 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4077 Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation. Vendor: Microsoft Product: Input Method Editor (IME) Japanese Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-4077 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-3153 The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2014-3153 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-7331 An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2013-7331 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3993 Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. Vendor: IBM Product: InfoSphere BigInsights Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2013-3993 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3896 Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application. Vendor: Microsoft Product: Silverlight Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2013-3896 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2423 Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity. Vendor: Oracle Product: Java Runtime Environment (JRE) Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2013-2423 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0431 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox. Vendor: Oracle Product: Java Runtime Environment (JRE) Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2013-0431 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0422 A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system. Vendor: Oracle Product: Java Runtime Environment (JRE) Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2013-0422 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0074 Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application. Vendor: Microsoft Product: Silverlight Added to CISA KEV: 2022-05-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2013-0074 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1710 Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer. Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2012-1710 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-1428 Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information. Vendor: Red Hat Product: JBoss Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2010-1428 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0840 Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors. Vendor: Oracle Product: Java Runtime Environment (JRE) Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Unknown Wed, 25 May 2022 00:00:00 +0000 CVE-2010-0840 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0738 The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method. Vendor: Red Hat Product: JBoss Added to CISA KEV: 2022-05-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-15 Known ransomware use: Known Wed, 25 May 2022 00:00:00 +0000 CVE-2010-0738 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8611 A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2018-8611 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19953 A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. Vendor: QNAP Product: Network Attached Storage (NAS) Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2018-19953 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19949 A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands. Vendor: QNAP Product: Network Attached Storage (NAS) Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2018-19949 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-19943 A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. Vendor: QNAP Product: Network Attached Storage (NAS) Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2018-19943 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0147 The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet. Vendor: Microsoft Product: SMBv1 server Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2017-0147 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0022 Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site. Vendor: Microsoft Product: XML Core Services Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-0022 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0005 The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-0005 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0149 Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-0149 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0210 A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-0210 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8291 Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile. Vendor: Artifex Product: Ghostscript Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-8291 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8543 Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2017-8543 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-18362 ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. Vendor: Kaseya Product: Virtual System/Server Administrator (VSA) Added to CISA KEV: 2022-05-24 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2017-18362 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0162 An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-0162 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3351 An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. Vendor: Microsoft Product: Internet Explorer and Edge Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Known Tue, 24 May 2022 00:00:00 +0000 CVE-2016-3351 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4655 The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application. Vendor: Apple Product: iOS Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-4655 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4656 A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application. Vendor: Apple Product: iOS Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-4656 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4657 Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-4657 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-6366 A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code. Vendor: Cisco Product: Adaptive Security Appliance (ASA) Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-6366 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-6367 A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code. Vendor: Cisco Product: Adaptive Security Appliance (ASA) Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-6367 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3298 An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-24 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-14 Known ransomware use: Unknown Tue, 24 May 2022 00:00:00 +0000 CVE-2016-3298 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20821 Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container. Vendor: Cisco Product: IOS XR Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2022-20821 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1048 Android kernel contains a use-after-free vulnerability that allows for privilege escalation. Vendor: Android Product: Kernel Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2021-1048 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-0920 Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. Vendor: Android Product: Kernel Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2021-0920 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30883 Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2021-30883 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1027 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2020-1027 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0638 Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Update Notification Manager Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Known Mon, 23 May 2022 00:00:00 +0000 CVE-2020-0638 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7286 Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-7286 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7287 Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution. Vendor: Apple Product: iOS Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-7287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0676 An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-0676 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-5786 Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page. Vendor: Google Product: Chrome Blink Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-5786 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0703 An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-0703 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0880 A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-0880 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-13720 Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. Vendor: Google Product: Chrome WebAudio Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-13720 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11707 Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-11707 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11708 Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-11708 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-8720 WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. Vendor: WebKitGTK Product: WebKitGTK Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-8720 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-18426 A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading. Vendor: Meta Platforms Product: WhatsApp Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2019-18426 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1385 A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Known Mon, 23 May 2022 00:00:00 +0000 CVE-2019-1385 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1130 A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Known Mon, 23 May 2022 00:00:00 +0000 CVE-2019-1130 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-5002 Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-05-23 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2018-5002 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8589 A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-05-23 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-13 Known ransomware use: Unknown Mon, 23 May 2022 00:00:00 +0000 CVE-2018-8589 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-30525 A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. Vendor: Zyxel Product: Multiple Firewalls Added to CISA KEV: 2022-05-16 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-06 Known ransomware use: Unknown Mon, 16 May 2022 00:00:00 +0000 CVE-2022-30525 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22947 Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. Vendor: VMware Product: Spring Cloud Gateway Added to CISA KEV: 2022-05-16 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-06 Known ransomware use: Unknown Mon, 16 May 2022 00:00:00 +0000 CVE-2022-22947 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-1388 F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. Vendor: F5 Product: BIG-IP Added to CISA KEV: 2022-05-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-31 Known ransomware use: Known Tue, 10 May 2022 00:00:00 +0000 CVE-2022-1388 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1789 A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-05-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-25 Known ransomware use: Unknown Wed, 04 May 2022 00:00:00 +0000 CVE-2021-1789 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-8506 A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2022-05-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-25 Known ransomware use: Unknown Wed, 04 May 2022 00:00:00 +0000 CVE-2019-8506 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4113 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-05-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-25 Known ransomware use: Unknown Wed, 04 May 2022 00:00:00 +0000 CVE-2014-4113 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0322 Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-05-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-25 Known ransomware use: Unknown Wed, 04 May 2022 00:00:00 +0000 CVE-2014-0322 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0160 The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information. Vendor: OpenSSL Product: OpenSSL Added to CISA KEV: 2022-05-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-25 Known ransomware use: Unknown Wed, 04 May 2022 00:00:00 +0000 CVE-2014-0160 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-29464 Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. Vendor: WSO2 Product: Multiple Products Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Known Mon, 25 Apr 2022 00:00:00 +0000 CVE-2022-29464 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26904 Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2022-26904 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21919 Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2022-21919 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0847 Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe." Vendor: Linux Product: Kernel Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2022-0847 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-41357 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2021-41357 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40450 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2021-40450 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1003029 Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. Vendor: Jenkins Product: Script Security Plugin Added to CISA KEV: 2022-04-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-16 Known ransomware use: Unknown Mon, 25 Apr 2022 00:00:00 +0000 CVE-2019-1003029 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-6882 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-04-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-10 Known ransomware use: Known Tue, 19 Apr 2022 00:00:00 +0000 CVE-2018-6882 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-3568 A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. Vendor: Meta Platforms Product: WhatsApp Added to CISA KEV: 2022-04-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-10 Known ransomware use: Unknown Tue, 19 Apr 2022 00:00:00 +0000 CVE-2019-3568 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22718 Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-04-19 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-10 Known ransomware use: Unknown Tue, 19 Apr 2022 00:00:00 +0000 CVE-2022-22718 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22960 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. Vendor: VMware Product: Multiple Products Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2022-22960 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-1364 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2022-1364 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-3929 Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. Vendor: Crestron Product: Multiple Products Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2019-3929 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16057 The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution. Vendor: D-Link Product: DNS-320 Storage Device Added to CISA KEV: 2022-04-15 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-06 Known ransomware use: Known Fri, 15 Apr 2022 00:00:00 +0000 CVE-2019-16057 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-7841 A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered. Vendor: Schneider Electric Product: U.motion Builder Added to CISA KEV: 2022-04-15 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2018-7841 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4523 The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS). Vendor: Trihedral Product: VTScada (formerly VTS) Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2016-4523 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0780 InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution. Vendor: InduSoft Product: Web Studio Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2014-0780 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-5330 Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi. Vendor: Ubiquiti Product: AirOS Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2010-5330 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2007-3010 masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands. Vendor: Alcatel Product: OmniPCX Enterprise Added to CISA KEV: 2022-04-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-06 Known ransomware use: Unknown Fri, 15 Apr 2022 00:00:00 +0000 CVE-2007-3010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22954 VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. Vendor: VMware Product: Workspace ONE Access and Identity Manager Added to CISA KEV: 2022-04-14 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-05 Known ransomware use: Known Thu, 14 Apr 2022 00:00:00 +0000 CVE-2022-22954 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24521 Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-04 Known ransomware use: Known Wed, 13 Apr 2022 00:00:00 +0000 CVE-2022-24521 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. Vendor: Drupal Product: Core Added to CISA KEV: 2022-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-04 Known ransomware use: Known Wed, 13 Apr 2022 00:00:00 +0000 CVE-2018-7602 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-20753 Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. Vendor: Kaseya Product: Virtual System/Server Administrator (VSA) Added to CISA KEV: 2022-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-04 Known ransomware use: Known Wed, 13 Apr 2022 00:00:00 +0000 CVE-2018-20753 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5123 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-5123 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5122 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-5122 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-3113 Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-3113 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2502 Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS). Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-04-13 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-2502 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0313 Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-0313 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0311 Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2015-0311 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-9163 Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-04-13 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-04 Known ransomware use: Unknown Wed, 13 Apr 2022 00:00:00 +0000 CVE-2014-9163 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-23176 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. Vendor: WatchGuard Product: Firebox and XTM Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2022-23176 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42287 Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Active Directory Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Known Mon, 11 Apr 2022 00:00:00 +0000 CVE-2021-42287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42278 Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Active Directory Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Known Mon, 11 Apr 2022 00:00:00 +0000 CVE-2021-42278 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-39793 Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. Vendor: Google Product: Pixel Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2021-39793 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27852 Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. Vendor: Checkbox Product: Checkbox Survey Added to CISA KEV: 2022-04-11 CISA required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2021-27852 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22600 Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2021-22600 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2509 QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. Vendor: QNAP Product: QNAP Network-Attached Storage (NAS) Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2020-2509 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11317 Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. Vendor: Telerik Product: User Interface (UI) for ASP.NET AJAX Added to CISA KEV: 2022-04-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-02 Known ransomware use: Unknown Mon, 11 Apr 2022 00:00:00 +0000 CVE-2017-11317 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-3156 Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. Vendor: Sudo Product: Sudo Added to CISA KEV: 2022-04-06 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-27 Known ransomware use: Unknown Wed, 06 Apr 2022 00:00:00 +0000 CVE-2021-3156 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31166 Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. Vendor: Microsoft Product: HTTP Protocol Stack Added to CISA KEV: 2022-04-06 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-27 Known ransomware use: Unknown Wed, 06 Apr 2022 00:00:00 +0000 CVE-2021-31166 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0148 The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. Vendor: Microsoft Product: SMBv1 server Added to CISA KEV: 2022-04-06 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-27 Known ransomware use: Known Wed, 06 Apr 2022 00:00:00 +0000 CVE-2017-0148 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22965 Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Vendor: VMware Product: Spring Framework Added to CISA KEV: 2022-04-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-25 Known ransomware use: Unknown Mon, 04 Apr 2022 00:00:00 +0000 CVE-2022-22965 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22675 macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. Vendor: Apple Product: macOS Added to CISA KEV: 2022-04-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-25 Known ransomware use: Unknown Mon, 04 Apr 2022 00:00:00 +0000 CVE-2022-22675 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22674 macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. Vendor: Apple Product: macOS Added to CISA KEV: 2022-04-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-25 Known ransomware use: Unknown Mon, 04 Apr 2022 00:00:00 +0000 CVE-2022-22674 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-45382 A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. Vendor: D-Link Product: Multiple Routers Added to CISA KEV: 2022-04-04 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-25 Known ransomware use: Unknown Mon, 04 Apr 2022 00:00:00 +0000 CVE-2021-45382 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26871 An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution. Vendor: Trend Micro Product: Apex Central Added to CISA KEV: 2022-03-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Unknown Thu, 31 Mar 2022 00:00:00 +0000 CVE-2022-26871 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-1040 An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. Vendor: Sophos Product: Firewall Added to CISA KEV: 2022-03-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Unknown Thu, 31 Mar 2022 00:00:00 +0000 CVE-2022-1040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34484 Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Unknown Thu, 31 Mar 2022 00:00:00 +0000 CVE-2021-34484 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-28799 QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. Vendor: QNAP Product: Network Attached Storage (NAS) Added to CISA KEV: 2022-03-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Known Thu, 31 Mar 2022 00:00:00 +0000 CVE-2021-28799 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21551 Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure. Vendor: Dell Product: dbutil Driver Added to CISA KEV: 2022-03-31 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Unknown Thu, 31 Mar 2022 00:00:00 +0000 CVE-2021-21551 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-10562 Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution. Vendor: Dasan Product: Gigabit Passive Optical Network (GPON) Routers Added to CISA KEV: 2022-03-31 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-21 Known ransomware use: Known Thu, 31 Mar 2022 00:00:00 +0000 CVE-2018-10562 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-10561 Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution. Vendor: Dasan Product: Gigabit Passive Optical Network (GPON) Routers Added to CISA KEV: 2022-03-31 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-21 Known ransomware use: Unknown Thu, 31 Mar 2022 00:00:00 +0000 CVE-2018-10561 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-1096 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2022-1096 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0543 Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. Vendor: Redis Product: Debian-specific Redis Servers Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2022-0543 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38646 Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2021-38646 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34486 Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2021-34486 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26085 Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. Vendor: Atlassian Product: Confluence Server Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2021-26085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20028 SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. Vendor: SonicWall Product: Secure Remote Access (SRA) Added to CISA KEV: 2022-03-28 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2021-20028 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7483 In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. Vendor: SonicWall Product: SMA100 Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2019-7483 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8440 An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2018-8440 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8406 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. Vendor: Microsoft Product: DirectX Graphics Kernel (DXGKRNL) Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2018-8406 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8405 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. Vendor: Microsoft Product: DirectX Graphics Kernel (DXGKRNL) Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2018-8405 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0213 Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2017-0213 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0059 Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2017-0059 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0037 Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution. Vendor: Microsoft Product: Edge and Internet Explorer Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2017-0037 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7201 The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. Vendor: Microsoft Product: Edge Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2016-7201 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7200 The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. Vendor: Microsoft Product: Edge Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2016-7200 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0189 The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2016-0189 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0151 The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Client-Server Run-time Subsystem (CSRSS) Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2016-0151 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0040 The kernel in Microsoft Windows allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2016-0040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2426 A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2015-2426 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2419 JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2015-2419 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1770 Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2015-1770 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3660 The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2013-3660 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2729 Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2013-2729 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2551 Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2013-2551 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2465 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Known Mon, 28 Mar 2022 00:00:00 +0000 CVE-2013-2465 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-1690 Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2013-1690 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-5076 The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2012-5076 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-2539 Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data. Vendor: Microsoft Product: Word Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2012-2539 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-2034 Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS). Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-28 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2012-2034 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0518 Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2012-0518 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-2005 afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Ancillary Function Driver (afd.sys) Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-18 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2011-2005 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-4398 Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-21 Known ransomware use: Unknown Mon, 28 Mar 2022 00:00:00 +0000 CVE-2010-4398 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26318 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code. Vendor: WatchGuard Product: Firebox and XTM Appliances Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2022-26318 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26143 A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. Vendor: Mitel Product: MiCollab, MiVoice Business Express Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2022-26143 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21999 Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2022-21999 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42237 Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution. Vendor: Sitecore Product: XP Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2021-42237 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22941 Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. Vendor: Citrix Product: ShareFile Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2021-22941 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9377 D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php. Vendor: D-Link Product: DIR-610 Devices Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-9377 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9054 Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. Vendor: Zyxel Product: Multiple Network-Attached Storage (NAS) Devices Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-9054 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-7247 smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. Vendor: OpenBSD Product: OpenSMTPD Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-7247 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5410 Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files. Vendor: VMware Tanzu Product: Spring Cloud Configuration (Config) Server Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-5410 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-25223 A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. Vendor: Sophos Product: SG UTM Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-25223 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2506 QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information. Vendor: QNAP Systems Product: Helpdesk Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-2506 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2021 Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-2021 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1956 Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution. Vendor: Apache Product: Kylin Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-1956 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1631 A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution. Vendor: Juniper Product: Junos OS Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2020-1631 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-6340 In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. Vendor: Drupal Product: Core Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-6340 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-2616 Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass. Vendor: Oracle Product: BI Publisher (Formerly XML Publisher) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-2616 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16920 Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise. Vendor: D-Link Product: Multiple Routers Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-16920 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-15107 An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. Vendor: Webmin Product: Webmin Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-15107 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-12991 Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. Vendor: Citrix Product: SD-WAN and NetScaler Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-12991 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-12989 Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection. Vendor: Citrix Product: SD-WAN and NetScaler Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-12989 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11043 In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution. Vendor: PHP Product: FastCGI Process Manager (FPM) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-11043 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-10068 Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution. Vendor: Kentico Product: Xperience Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-10068 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1003030 Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution. Vendor: Jenkins Product: Matrix Project Plugin Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-1003030 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0903 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. Vendor: Microsoft Product: Graphics Device Interface (GDI) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2019-0903 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8414 A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-8414 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8373 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. Vendor: Microsoft Product: Internet Explorer Scripting Engine Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-8373 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-6961 VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. Vendor: VMware Product: SD-WAN Edge Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-6961 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14839 LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability. Vendor: LG Product: N1A1 NAS Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-14839 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-1273 Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution. Vendor: VMware Tanzu Product: Spring Data Commons Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-1273 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-11138 The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution. Vendor: Quest Product: KACE System Management Appliance Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-11138 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0147 A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. Vendor: Cisco Product: Secure Access Control System (ACS) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-0147 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0125 A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system. Vendor: Cisco Product: VPN Routers Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2018-0125 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6334 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands Vendor: NETGEAR Product: DGN2200 Devices Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-6334 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6316 A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server. Vendor: Citrix Product: NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-6316 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-3881 A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. Vendor: Cisco Product: IOS and IOS XE Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-3881 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12617 When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Vendor: Apache Product: Tomcat Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-12617 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12615 When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Vendor: Apache Product: Tomcat Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-12615 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0146 The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2017-0146 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7892 Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-7892 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4171 Unspecified vulnerability in Adobe Flash Player allows for remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-4171 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-1555 Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution. Vendor: NETGEAR Product: Wireless Access Point (WAP) Devices Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-1555 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-11021 setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command. Vendor: D-Link Product: DCS-930L Devices Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-11021 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-10174 The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution. Vendor: NETGEAR Product: WNR2000v5 Router Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-10174 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0752 Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files. Vendor: Rails Product: Ruby on Rails Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2016-0752 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-4068 Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service. Vendor: Arcserve Product: Unified Data Protection (UDP) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2015-4068 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-3035 Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/. Vendor: TP-Link Product: Multiple Archer Devices Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2015-3035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1427 The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. Vendor: Elastic Product: Elasticsearch Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2015-1427 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1187 The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution. Vendor: D-Link and TRENDnet Product: Multiple Devices Added to CISA KEV: 2022-03-25 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2015-1187 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-0666 Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files. Vendor: Cisco Product: Prime Data Center Network Manager (DCNM) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2015-0666 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6332 OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2014-6332 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6324 The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges. Vendor: Microsoft Product: Kerberos Key Distribution Center (KDC) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2014-6324 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6287 The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs. Vendor: Rejetto Product: HTTP File Server (HFS) Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2014-6287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-3120 Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code. Vendor: Elastic Product: Elasticsearch Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2014-3120 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0130 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request. Vendor: Rails Product: Ruby on Rails Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2014-0130 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-5223 A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML. Vendor: D-Link Product: DSL-2760U Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2013-5223 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-4810 HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet. Vendor: Hewlett Packard (HP) Product: ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2013-4810 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-2251 Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. Vendor: Apache Product: Struts Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2013-2251 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1823 sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. Vendor: PHP Product: PHP Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2012-1823 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-4345 Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands. Vendor: Exim Product: Exim Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2010-4345 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-4344 Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session. Vendor: Exim Product: Exim Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2010-4344 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-3035 Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). Vendor: Cisco Product: IOS XR Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2010-3035 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-2861 A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Known Fri, 25 Mar 2022 00:00:00 +0000 CVE-2010-2861 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-2055 Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). Vendor: Cisco Product: IOS XR Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2009-2055 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-1151 Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Vendor: phpMyAdmin Product: phpMyAdmin Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2009-1151 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-0927 Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2009-0927 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2005-2773 HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system. Vendor: Hewlett Packard (HP) Product: OpenView Network Node Manager Added to CISA KEV: 2022-03-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-15 Known ransomware use: Unknown Fri, 25 Mar 2022 00:00:00 +0000 CVE-2005-2773 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5135 A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. Vendor: SonicWall Product: SonicOS Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2020-5135 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1405 A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1405 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1322 A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1322 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1315 A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1315 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1253 A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1253 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1132 A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Unknown Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1132 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1129 A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1129 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1069 A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations. Vendor: Microsoft Product: Task Scheduler Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1069 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1064 A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-1064 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0841 A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-0841 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0543 A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2019-0543 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8120 A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2018-8120 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0101 A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2017-0101 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3309 A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2016-3309 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2546 The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-03-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-04-05 Known ransomware use: Known Tue, 15 Mar 2022 00:00:00 +0000 CVE-2015-2546 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26486 Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. Vendor: Mozilla Product: Firefox Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-21 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2022-26486 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-26485 Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. Vendor: Mozilla Product: Firefox Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-21 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2022-26485 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21973 VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. Vendor: VMware Product: vCenter Server and Cloud Foundation Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-21 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2021-21973 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8218 A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. Vendor: Pulse Secure Product: Pulse Connect Secure Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2020-8218 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11581 Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution. Vendor: Atlassian Product: Jira Server and Data Center Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2019-11581 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6077 NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution. Vendor: NETGEAR Product: Wireless Router DGN2200 Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2017-6077 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-6277 NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. Vendor: NETGEAR Product: Multiple Routers Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2016-6277 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0631 Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2013-0631 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0629 Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2013-0629 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0625 Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Unknown Mon, 07 Mar 2022 00:00:00 +0000 CVE-2013-0625 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-3960 Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. Vendor: Adobe Product: BlazeDS Added to CISA KEV: 2022-03-07 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-09-07 Known ransomware use: Known Mon, 07 Mar 2022 00:00:00 +0000 CVE-2009-3960 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20708 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). Vendor: Cisco Product: Small Business RV160, RV260, RV340, and RV345 Series Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2022-20708 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20703 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). Vendor: Cisco Product: Small Business RV160, RV260, RV340, and RV345 Series Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2022-20703 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20701 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). Vendor: Cisco Product: Small Business RV160, RV260, RV340, and RV345 Series Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2022-20701 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20700 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). Vendor: Cisco Product: Small Business RV160, RV260, RV340, and RV345 Series Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2022-20700 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-20699 A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). Vendor: Cisco Product: Small Business RV160, RV260, RV340, and RV345 Series Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2022-20699 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-41379 Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2021-41379 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1938 Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. Vendor: Apache Product: Tomcat Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2020-1938 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11899 The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability. Vendor: Treck TCP/IP stack Product: IPv6 Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2020-11899 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16928 Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. Vendor: Exim Product: Exim Internet Mailer Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2019-16928 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1652 A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. Vendor: Cisco Product: Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2019-1652 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1297 A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory. Vendor: Microsoft Product: Excel Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2019-1297 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8581 A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-8581 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8298 The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution. Vendor: ChakraCore Product: ChakraCore scripting engine Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-8298 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0180 A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. Vendor: Cisco Product: IOS Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0180 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0179 A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. Vendor: Cisco Product: IOS Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0179 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0175 Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Vendor: Cisco Product: IOS, XR, and XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0175 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0174 A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). Vendor: Cisco Product: IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0174 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0173 A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS). Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0173 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0172 A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0172 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0167 There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code. Vendor: Cisco Product: IOS, XR, and XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0167 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0161 A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition. Vendor: Cisco Product: IOS Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0161 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0159 A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition. Vendor: Cisco Product: IOS Software and Cisco IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0159 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0158 A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition. Vendor: Cisco Product: IOS Software and Cisco IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0158 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0156 A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition. Vendor: Cisco Product: IOS Software and Cisco IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0156 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0155 A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition. Vendor: Cisco Product: Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0155 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0154 A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition. Vendor: Cisco Product: IOS Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0154 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0151 A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-17 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2018-0151 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8540 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". Vendor: Microsoft Product: Malware Protection Engine Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-8540 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6744 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6744 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6743 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6743 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6740 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6740 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6739 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6739 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6738 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6738 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6737 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6737 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6736 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6736 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6663 A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS). Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6663 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6627 A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-6627 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12319 A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. Vendor: Cisco Product: IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12319 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12240 The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12240 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12238 A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service. Vendor: Cisco Product: Catalyst 6800 Series Switches Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12238 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12237 A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service. Vendor: Cisco Product: IOS and IOS XE Software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12237 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12235 A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12235 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12234 There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12234 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12233 There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12233 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12232 A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12232 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12231 A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service. Vendor: Cisco Product: IOS software Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-12231 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11826 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-11826 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11292 Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-11292 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0261 Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-0261 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0001 The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges Vendor: Microsoft Product: Graphics Device Interface (GDI) Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2017-0001 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-8562 An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. Vendor: Siemens Product: SIMATIC CP Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-8562 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7855 Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-7855 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7262 A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. Vendor: Microsoft Product: Excel Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-7262 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7193 Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-7193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-5195 Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges. Vendor: Linux Product: Kernel Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-5195 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4117 An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-4117 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-1019 Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-1019 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0099 A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2016-0099 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-7645 Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-7645 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-5119 A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-5119 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-4902 Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-4902 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-3043 A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-3043 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2590 An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-2590 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2545 Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-2545 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2424 Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document. Vendor: Microsoft Product: PowerPoint Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-2424 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2387 ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: ATM Font Driver Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-2387 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1701 An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-1701 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1642 Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2015-1642 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4114 A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2014-4114 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-0496 Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2014-0496 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-5065 Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-5065 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3897 A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-3897 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3346 Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-3346 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-1675 Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. Vendor: Mozilla Product: Firefox Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-1675 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-1347 This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-1347 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0641 A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution. Vendor: Adobe Product: Reader Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-0641 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0640 An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-0640 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-0632 An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2013-0632 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-4681 The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2012-4681 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1856 The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2012-1856 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1723 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2012-1723 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-1535 Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2012-1535 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0507 An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. Vendor: Oracle Product: Java SE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2012-0507 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-3544 An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. Vendor: Oracle Product: Java SE JDK and JRE Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2011-3544 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-1889 A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application. Vendor: Microsoft Product: Forefront Threat Management Gateway (TMG) Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2011-1889 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2011-0611 Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-03-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2011-0611 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-3333 A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2010-3333 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0232 The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2010-0232 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-0188 Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code. Vendor: Adobe Product: Reader and Acrobat Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2010-0188 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-3129 Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset. Vendor: Microsoft Product: Excel Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2009-3129 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2009-1123 The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2009-1123 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-3431 An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code. Vendor: Oracle Product: VirtualBox Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2008-3431 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2008-2992 Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Known Thu, 03 Mar 2022 00:00:00 +0000 CVE-2008-2992 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2004-0210 A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2004-0210 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2002-0367 smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-03-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-24 Known ransomware use: Unknown Thu, 03 Mar 2022 00:00:00 +0000 CVE-2002-0367 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24682 Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code. Vendor: Synacor Product: Zimbra Collaborate Suite (ZCS) Added to CISA KEV: 2022-02-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-11 Known ransomware use: Known Fri, 25 Feb 2022 00:00:00 +0000 CVE-2022-24682 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8570 A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-02-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-25 Known ransomware use: Unknown Fri, 25 Feb 2022 00:00:00 +0000 CVE-2017-8570 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0222 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-02-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-25 Known ransomware use: Unknown Fri, 25 Feb 2022 00:00:00 +0000 CVE-2017-0222 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6352 Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-02-25 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-25 Known ransomware use: Unknown Fri, 25 Feb 2022 00:00:00 +0000 CVE-2014-6352 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-23131 Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. Vendor: Zabbix Product: Frontend Added to CISA KEV: 2022-02-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-08 Known ransomware use: Unknown Tue, 22 Feb 2022 00:00:00 +0000 CVE-2022-23131 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-23134 Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. Vendor: Zabbix Product: Frontend Added to CISA KEV: 2022-02-22 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-08 Known ransomware use: Unknown Tue, 22 Feb 2022 00:00:00 +0000 CVE-2022-23134 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-24086 Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. Vendor: Adobe Product: Commerce and Magento Open Source Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-01 Known ransomware use: Unknown Tue, 15 Feb 2022 00:00:00 +0000 CVE-2022-24086 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-0609 Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Animation Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-03-01 Known ransomware use: Unknown Tue, 15 Feb 2022 00:00:00 +0000 CVE-2022-0609 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0752 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Known Tue, 15 Feb 2022 00:00:00 +0000 CVE-2019-0752 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8174 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution" Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Known Tue, 15 Feb 2022 00:00:00 +0000 CVE-2018-8174 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-20250 WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution Vendor: RARLAB Product: WinRAR Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Known Tue, 15 Feb 2022 00:00:00 +0000 CVE-2018-20250 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-15982 Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability Vendor: Adobe Product: Flash Player Added to CISA KEV: 2022-02-15 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-08-15 Known ransomware use: Known Tue, 15 Feb 2022 00:00:00 +0000 CVE-2018-15982 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-9841 PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. Vendor: PHPUnit Product: PHPUnit Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Unknown Tue, 15 Feb 2022 00:00:00 +0000 CVE-2017-9841 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-1761 Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. Vendor: Microsoft Product: Word Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Unknown Tue, 15 Feb 2022 00:00:00 +0000 CVE-2014-1761 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3906 Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. Vendor: Microsoft Product: Graphics Component Added to CISA KEV: 2022-02-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-15 Known ransomware use: Unknown Tue, 15 Feb 2022 00:00:00 +0000 CVE-2013-3906 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22620 Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2022-02-11 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-25 Known ransomware use: Unknown Fri, 11 Feb 2022 00:00:00 +0000 CVE-2022-22620 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36934 If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-24 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2021-36934 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0796 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. Vendor: Microsoft Product: SMBv3 Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Known Thu, 10 Feb 2022 00:00:00 +0000 CVE-2020-0796 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-1000861 A code execution vulnerability exists in the Stapler web framework used by Jenkins Vendor: Jenkins Product: Jenkins Stapler Web Framework Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2018-1000861 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-9791 The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. Vendor: Apache Product: Struts 1 Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-9791 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8464 Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-8464 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-10271 Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Known Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-10271 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0263 Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-0263 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0262 A remote code execution vulnerability exists in Microsoft Office. Vendor: Microsoft Product: Office Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-0262 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0145 The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. Vendor: Microsoft Product: SMBv1 Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Known Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-0145 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0144 The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. Vendor: Microsoft Product: SMBv1 Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Known Thu, 10 Feb 2022 00:00:00 +0000 CVE-2017-0144 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3088 The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request Vendor: Apache Product: ActiveMQ Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2016-3088 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-2051 D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface. Vendor: D-Link Product: DIR-645 Router Added to CISA KEV: 2022-02-10 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2015-2051 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1635 Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution. Vendor: Microsoft Product: HTTP.sys Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2015-1635 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1130 The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges. Vendor: Apple Product: OS X Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2015-1130 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-4404 Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context. Vendor: Apple Product: OS X Added to CISA KEV: 2022-02-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-08-10 Known ransomware use: Unknown Thu, 10 Feb 2022 00:00:00 +0000 CVE-2014-4404 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-21882 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-02-04 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-18 Known ransomware use: Known Fri, 04 Feb 2022 00:00:00 +0000 CVE-2022-21882 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2022-22587 Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges. Vendor: Apple Product: iOS and macOS Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-11 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2022-22587 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20038 SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. Vendor: SonicWall Product: SMA 100 Appliances Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-11 Known ransomware use: Known Fri, 28 Jan 2022 00:00:00 +0000 CVE-2021-20038 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5722 Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root. Vendor: Grandstream Product: UCM6200 Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2020-5722 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0787 Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Known Fri, 28 Jan 2022 00:00:00 +0000 CVE-2020-0787 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-5689 Intel products contain a vulnerability which can allow attackers to perform privilege escalation. Vendor: Intel Product: Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2017-5689 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-1776 Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2014-1776 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-6271 GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. Vendor: GNU Product: Bourne-Again Shell (Bash) Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2014-6271 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-7169 GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271. Vendor: GNU Product: Bourne-Again Shell (Bash) Added to CISA KEV: 2022-01-28 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-28 Known ransomware use: Unknown Fri, 28 Jan 2022 00:00:00 +0000 CVE-2014-7169 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2006-1547 ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). Vendor: Apache Product: Struts 1 Added to CISA KEV: 2022-01-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-21 Known ransomware use: Unknown Fri, 21 Jan 2022 00:00:00 +0000 CVE-2006-1547 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0391 The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution. Vendor: Apache Product: Struts 2 Added to CISA KEV: 2022-01-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-21 Known ransomware use: Unknown Fri, 21 Jan 2022 00:00:00 +0000 CVE-2012-0391 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8453 Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-01-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-21 Known ransomware use: Known Fri, 21 Jan 2022 00:00:00 +0000 CVE-2018-8453 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35247 SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization. Vendor: SolarWinds Product: Serv-U Added to CISA KEV: 2022-01-21 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-04 Known ransomware use: Unknown Fri, 21 Jan 2022 00:00:00 +0000 CVE-2021-35247 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-32648 In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. Vendor: October CMS Product: October CMS Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-32648 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25296 Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. Vendor: Nagios Product: Nagios XI Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-25296 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25297 Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. Vendor: Nagios Product: Nagios XI Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-25297 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-25298 Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. Vendor: Nagios Product: Nagios XI Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-25298 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40870 Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. Vendor: Aviatrix Product: Aviatrix Controller Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-40870 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33766 Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-33766 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21975 Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. Vendor: VMware Product: vRealize Operations Manager API Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Known Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-21975 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21315 In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. Vendor: Npm package Product: System Information Library for Node.JS Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-21315 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22991 The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. Vendor: F5 Product: BIG-IP Traffic Management Microkernel Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-02-01 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2021-22991 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14864 Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. Vendor: Oracle Product: Intelligence Enterprise Edition Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2020-14864 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-13671 Improper sanitization in the extension file names is present in Drupal core. Vendor: Drupal Product: Drupal core Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2020-13671 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11978 A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. Vendor: Apache Product: Airflow Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2020-11978 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-13927 The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. Vendor: Apache Product: Airflow's Experimental API Added to CISA KEV: 2022-01-18 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-18 Known ransomware use: Unknown Tue, 18 Jan 2022 00:00:00 +0000 CVE-2020-13927 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22017 Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-01-24 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2021-22017 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36260 A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. Vendor: Hikvision Product: Security cameras web server Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-01-24 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2021-36260 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6572 Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. Vendor: Google Product: Chrome Media Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2020-6572 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1458 A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Known Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-1458 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2013-3900 A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. Vendor: Microsoft Product: WinVerifyTrust function Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2013-3900 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-2725 Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Known Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-2725 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. Vendor: Synacor Product: Zimbra Collaboration Suite (ZCS) Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-9670 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-13382 An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. Vendor: Fortinet Product: FortiOS and FortiProxy Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Known Mon, 10 Jan 2022 00:00:00 +0000 CVE-2018-13382 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-13383 A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. Vendor: Fortinet Product: FortiOS and FortiProxy Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Known Mon, 10 Jan 2022 00:00:00 +0000 CVE-2018-13383 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1579 Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. Vendor: Palo Alto Networks Product: PAN-OS Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Known Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-1579 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-10149 Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. Vendor: Exim Product: Mail Transfer Agent (MTA) Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-10149 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-7450 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands Vendor: IBM Product: WebSphere Application Server and Server Hypervisor Edition Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2015-7450 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-1000486 Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution Vendor: Primetek Product: Primefaces Application Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2017-1000486 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7609 Kibana contain an arbitrary code execution flaw in the Timelion visualizer. Vendor: Elastic Product: Kibana Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-07-10 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2019-7609 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27860 A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. Vendor: FatPipe Product: WARP, IPVPN, and MPVPN software Added to CISA KEV: 2022-01-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-01-24 Known ransomware use: Unknown Mon, 10 Jan 2022 00:00:00 +0000 CVE-2021-27860 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-43890 Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-12-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-29 Known ransomware use: Known Wed, 15 Dec 2021 00:00:00 +0000 CVE-2021-43890 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-4102 Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-12-15 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-29 Known ransomware use: Unknown Wed, 15 Dec 2021 00:00:00 +0000 CVE-2021-4102 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44515 Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. Vendor: Zoho Product: Desktop Central Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-24 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2021-44515 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-13272 Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access. Vendor: Linux Product: Kernel Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2019-13272 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35394 RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. Vendor: Realtek Product: Jungle Software Development Kit (SDK) Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-24 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2021-35394 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7238 Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution. Vendor: Sonatype Product: Nexus Repository Manager Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2019-7238 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0193 The optional Apache Solr module DataImportHandler contains a code injection vulnerability. Vendor: Apache Product: Solr Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2019-0193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44168 Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-24 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2021-44168 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-17562 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. Vendor: Embedthis Product: GoAhead Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2017-17562 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-12149 The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. Vendor: Red Hat Product: JBoss Application Server Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Known Fri, 10 Dec 2021 00:00:00 +0000 CVE-2017-12149 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-1871 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured. Vendor: Red Hat Product: JBoss Seam 2 Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2010-1871 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17463 FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. Vendor: Fuel CMS Product: Fuel CMS Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2020-17463 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8816 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Vendor: Pi-hole Product: AdminLTE Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2020-8816 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-10758 mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. Vendor: MongoDB Product: mongo-express Added to CISA KEV: 2021-12-10 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-10 Known ransomware use: Unknown Fri, 10 Dec 2021 00:00:00 +0000 CVE-2019-10758 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. Vendor: Apache Product: Log4j2 Added to CISA KEV: 2021-12-10 CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. Federal due date: 2021-12-24 Known ransomware use: Known Fri, 10 Dec 2021 00:00:00 +0000 CVE-2021-44228 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11261 Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Vendor: Qualcomm Product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Added to CISA KEV: 2021-12-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-01 Known ransomware use: Unknown Wed, 01 Dec 2021 00:00:00 +0000 CVE-2020-11261 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14847 MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. Vendor: MikroTik Product: RouterOS Added to CISA KEV: 2021-12-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-06-01 Known ransomware use: Unknown Wed, 01 Dec 2021 00:00:00 +0000 CVE-2018-14847 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-37415 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication Vendor: Zoho Product: ManageEngine ServiceDesk Plus (SDP) Added to CISA KEV: 2021-12-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-15 Known ransomware use: Unknown Wed, 01 Dec 2021 00:00:00 +0000 CVE-2021-37415 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40438 A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. Vendor: Apache Product: Apache Added to CISA KEV: 2021-12-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-15 Known ransomware use: Known Wed, 01 Dec 2021 00:00:00 +0000 CVE-2021-40438 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution Vendor: Zoho Product: ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus Added to CISA KEV: 2021-12-01 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-15 Known ransomware use: Unknown Wed, 01 Dec 2021 00:00:00 +0000 CVE-2021-44077 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22204 Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Vendor: Perl Product: Exiftool Added to CISA KEV: 2021-11-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-01 Known ransomware use: Unknown Wed, 17 Nov 2021 00:00:00 +0000 CVE-2021-22204 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40449 Unspecified vulnerability allows for an authenticated user to escalate privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-01 Known ransomware use: Known Wed, 17 Nov 2021 00:00:00 +0000 CVE-2021-40449 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42321 An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. Vendor: Microsoft Product: Exchange Added to CISA KEV: 2021-11-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-01 Known ransomware use: Known Wed, 17 Nov 2021 00:00:00 +0000 CVE-2021-42321 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42292 A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-17 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-12-01 Known ransomware use: Unknown Wed, 17 Nov 2021 00:00:00 +0000 CVE-2021-42292 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27104 Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. Vendor: Accellion Product: FTA Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27104 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27102 Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. Vendor: Accellion Product: FTA Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27102 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27101 Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. Vendor: Accellion Product: FTA Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27101 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27103 Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. Vendor: Accellion Product: FTA Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27103 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21017 Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21017 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-28550 Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. Vendor: Adobe Product: Acrobat and Reader Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-28550 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-4939 Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-4939 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-15961 Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. Vendor: Adobe Product: ColdFusion Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-15961 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-4878 Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution. Vendor: Adobe Product: Flash Player Added to CISA KEV: 2021-11-03 CISA required action: The impacted product is end-of-life and should be disconnected if still in use. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-4878 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5735 Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code. Vendor: Amcrest Product: Cameras and Network Video Recorder (NVR) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-5735 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-2215 Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu." Vendor: Android Product: Android Kernel Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-2215 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0041 Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu." Vendor: Android Product: Android Kernel Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0041 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0069 Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu." Vendor: MediaTek Product: Multiple Chipsets Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0069 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-9805 Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. Vendor: Apache Product: Struts Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-9805 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42013 Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773. Vendor: Apache Product: HTTP Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-42013 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-41773 Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013. Vendor: Apache Product: HTTP Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-41773 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0211 Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard. Vendor: Apache Product: HTTP Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0211 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-4437 Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature. Vendor: Apache Product: Shiro Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-4437 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-17558 The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. Vendor: Apache Product: Solr Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-17558 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17530 Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. Vendor: Apache Product: Struts Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-17530 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-5638 Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. Vendor: Apache Product: Struts Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-5638 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-11776 Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. Vendor: Apache Product: Struts Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-11776 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30858 Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30858 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-6223 Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction. Vendor: Apple Product: iOS and macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-6223 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30860 Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30860 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-27930 Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-27930 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30807 Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30807 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-27950 Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-27950 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-27932 Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-27932 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9818 Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message. Vendor: Apple Product: iOS, iPadOS, and watchOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-9818 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9819 Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message. Vendor: Apple Product: iOS, iPadOS, and watchOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-9819 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30762 Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30762 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1782 Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1782 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1870 Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1870 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1871 Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1871 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1879 Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS, iPadOS, and watchOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1879 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30661 Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30661 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30666 Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30666 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30713 Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. Vendor: Apple Product: macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30713 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30657 Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks. Vendor: Apple Product: macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30657 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30665 Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30665 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30663 Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30663 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30761 Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Vendor: Apple Product: iOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30761 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30869 Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. Vendor: Apple Product: iOS, iPadOS, and macOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30869 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-9859 Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges. Vendor: Apple Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-9859 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20090 Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. Vendor: Arcadyan Product: Buffalo Firmware Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-20090 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27562 Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers. Vendor: Arm Product: Trusted Firmware Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27562 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-28664 Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-28664 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-28663 Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information. Vendor: Arm Product: Mali Graphics Processing Unit (GPU) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-28663 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-3398 Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution. Vendor: Atlassian Product: Confluence Server and Data Center Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-3398 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26084 Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. Vendor: Atlassian Product: Confluence Server and Data Center Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-26084 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11580 Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds. Vendor: Atlassian Product: Crowd and Crowd Data Center Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-11580 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-3396 Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution. Vendor: Atlassian Product: Confluence Server and Data Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-3396 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-42258 BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution. Vendor: BQE Product: BillQuick Web Suite Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-42258 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3452 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3580 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information. Vendor: Cisco Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3580 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user. Vendor: Cisco Product: HyperFlex HX Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1497 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1498 Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user. Vendor: Cisco Product: HyperFlex HX Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1498 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0171 Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device. Vendor: Cisco Product: IOS and IOS XE Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-0171 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3118 Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device. Vendor: Cisco Product: IOS XR Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3118 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3566 Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. Vendor: Cisco Product: IOS XR Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3566 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3569 Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. Vendor: Cisco Product: IOS XR Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3569 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3161 Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition. Vendor: Cisco Product: Cisco IP Phones Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3161 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1653 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information. Vendor: Cisco Product: Small Business RV320 and RV325 Routers Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-1653 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0296 Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure. Vendor: Cisco Product: Adaptive Security Appliance (ASA) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-0296 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-13608 Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information. Vendor: Citrix Product: StoreFront Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-13608 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8193 Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation. Vendor: Citrix Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8195 Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. Vendor: Citrix Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8195 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8196 Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. Vendor: Citrix Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8196 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-19781 Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. Vendor: Citrix Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-19781 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11634 Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. Vendor: Citrix Product: Workspace Application and Receiver for Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-11634 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-29557 D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution. Vendor: D-Link Product: DIR-825 R1 Devices Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-29557 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-25506 D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. Vendor: D-Link Product: DNS-320 Device Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-25506 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-15811 DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. Vendor: DotNetNuke (DNN) Product: DotNetNuke (DNN) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-15811 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-18325 DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811. Vendor: DotNetNuke (DNN) Product: DotNetNuke (DNN) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-18325 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-9822 DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization. Vendor: DotNetNuke (DNN) Product: DotNetNuke (DNN) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-9822 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-15752 Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\. Vendor: Docker Product: Desktop Community Edition Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-15752 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8515 DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution. Vendor: DrayTek Product: Multiple Vigor Routers Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8515 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-7600 Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise. Vendor: Drupal Product: Drupal Core Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-7600 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22205 GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. Vendor: GitLab Product: Community and Enterprise Editions Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22205 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-6789 Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution. Vendor: Exim Product: Exim Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-6789 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8657 EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token. Vendor: EyesOfNetwork Product: EyesOfNetwork Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8657 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8655 EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7. Vendor: EyesOfNetwork Product: EyesOfNetwork Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8655 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. Vendor: F5 Product: BIG-IP Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-5902 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services. Vendor: F5 Product: BIG-IP and BIG-IQ Centralized Management Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22986 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35464 ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend). Vendor: ForgeRock Product: Access Management (AM) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-35464 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-5591 Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-5591 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-12812 Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-12812 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-13379 Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. Vendor: Fortinet Product: FortiOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-13379 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-16010 Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. Vendor: Google Product: Chrome for Android UI Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-16010 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-15999 Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. Vendor: Google Product: Chrome FreeType Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-15999 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21166 Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21166 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-16017 Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. Vendor: Google Product: Chrome Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-16017 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-37976 Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-37976 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-16009 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-16009 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30632 Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30632 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-16013 Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-16013 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30633 Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Indexed DB API Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30633 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21148 Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21148 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-37973 Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. Vendor: Google Product: Chromium Portals Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-37973 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30551 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30551 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-37975 Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-37975 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6418 Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-6418 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30554 Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium WebGL Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30554 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21206 Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Blink Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21206 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38000 Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Intents Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38000 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38003 Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38003 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21224 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21224 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21193 Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium Blink Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21193 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21220 Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21220 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30563 Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Vendor: Google Product: Chromium V8 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30563 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-4430 IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system. Vendor: IBM Product: Data Risk Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-4430 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-4427 IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. Vendor: IBM Product: Data Risk Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-4427 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-4428 IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.� Vendor: IBM Product: Data Risk Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-4428 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-4716 IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. Vendor: IBM Product: Planning Analytics Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-4716 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3715 ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading. Vendor: ImageMagick Product: ImageMagick Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-3715 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3718 ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image. Vendor: ImageMagick Product: ImageMagick Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-3718 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-15505 Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution. Vendor: Ivanti Product: MobileIron Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-15505 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-30116 Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system. Vendor: Kaseya Product: Virtual System/Server Administrator (VSA) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-30116 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-7961 Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services. Vendor: Liferay Product: Liferay Portal Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-7961 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-23874 McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense. Vendor: McAfee Product: McAfee Total Protection (MTP) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-23874 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22506 Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used. Vendor: Micro Focus Product: Micro Focus Access Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22506 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22502 Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution. Vendor: Micro Focus Product: Operation Bridge Reporter (OBR) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22502 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2014-1812 Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2014-1812 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38647 Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution. Vendor: Microsoft Product: Open Management Infrastructure (OMI) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38647 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0167 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-0167 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0878 Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user. Vendor: Microsoft Product: Edge and Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0878 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31955 Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31955 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1647 Microsoft Defender contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Defender Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1647 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33739 Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-33739 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-0185 Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-0185 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0683 Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0683 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17087 Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-17087 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33742 Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-33742 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31199 Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Enhanced Cryptographic Provider Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-33771 Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-33771 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31956 Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31956 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31201 Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Enhanced Cryptographic Provider Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31201 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31979 Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31979 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0938 Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0938 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17144 Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-17144 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0986 Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0986 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1020 Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1020 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38645 Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Open Management Infrastructure (OMI) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38645 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34523 Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-34523 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-7269 Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request. Vendor: Microsoft Product: Internet Information Services (IIS) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-7269 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36948 Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-36948 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38649 Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. Vendor: Microsoft Product: Open Management Infrastructure (OMI) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38649 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0688 Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0688 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0143 Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-0143 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-7255 Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-7255 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0708 Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep. Vendor: Microsoft Product: Remote Desktop Services Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0708 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34473 Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-34473 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1464 Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1464 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1732 Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1732 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34527 Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-34527 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31207 Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31207 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0803 Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0803 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1040 Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system. Vendor: Microsoft Product: Hyper-V RemoteFX Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1040 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-28310 Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-28310 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1350 Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1350 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26411 Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-26411 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0859 Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0859 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40444 Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: MSHTML Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-40444 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-8759 Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system. Vendor: Microsoft Product: .NET Framework Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-8759 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-8653 Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-8653 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0797 Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0797 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36942 Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-36942 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1215 Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-1215 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0798 Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-0798 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-0802 Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-0802 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-0158 Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user. Vendor: Microsoft Product: MSCOMCTL.OCX Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2012-0158 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-1641 Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2015-1641 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27085 Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0541 Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability. Vendor: Microsoft Product: MSHTML Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0541 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11882 Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-11882 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0674 Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0674 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27059 Microsoft Office contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27059 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1367 Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-1367 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-0199 Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution. Vendor: Microsoft Product: Office and WordPad Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-0199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1380 Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1380 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1429 Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-1429 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-11774 Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-11774 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0968 Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. Vendor: Microsoft Product: Internet Explorer Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0968 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1472 Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon. Vendor: Microsoft Product: Netlogon Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1472 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26855 Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-26855 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26858 Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-26858 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27065 Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27065 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1054 Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1054 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1675 Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1675 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-34448 Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-34448 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0601 Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0601 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0604 Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account. Vendor: Microsoft Product: SharePoint Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0604 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-0646 Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution. Vendor: Microsoft Product: .NET Framework Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-0646 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0808 Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode. Vendor: Microsoft Product: Win32k Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0808 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-26857 Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. Vendor: Microsoft Product: Exchange Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-26857 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-1147 Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content. Vendor: Microsoft Product: .NET Framework, SharePoint, Visual Studio Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-1147 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-1214 Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-1214 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3235 Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution. Vendor: Microsoft Product: Office Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-3235 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-0863 Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-0863 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36955 Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Vendor: Microsoft Product: Windows Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-36955 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-38648 Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. Vendor: Microsoft Product: Open Management Infrastructure (OMI) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-38648 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6819 Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-6819 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6820 Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-6820 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-17026 Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. Vendor: Mozilla Product: Firefox and Thunderbird Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-17026 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-15949 Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root. Vendor: Nagios Product: Nagios XI Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-15949 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-26919 Netgear JGS516PE devices contain a missing function level access control vulnerability. Vendor: NETGEAR Product: JGS516PE Devices Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-26919 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-19356 Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page. Vendor: Netis Product: WF2419 Devices Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-19356 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-2555 Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR). Vendor: Oracle Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-2555 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2012-3152 Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems. Vendor: Oracle Product: Fusion Middleware Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2012-3152 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14871 Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. Vendor: Oracle Product: Solaris and Zettabyte File System (ZFS) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-14871 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2015-4852 Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2015-4852 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14750 Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-14750 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14882 Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-14882 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-14883 Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. Vendor: Oracle Product: WebLogic Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-14883 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8644 PlaySMS contains a server-side template injection vulnerability that allows for remote code execution. Vendor: PlaySMS Product: PlaySMS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8644 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-18935 Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process. Vendor: Progress Product: Telerik UI for ASP.NET AJAX Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-18935 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22893 Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22893 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8243 Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8243 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22900 Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22900 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22894 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8260 Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8260 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22899 Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22899 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11510 Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI. Vendor: Ivanti Product: Pulse Connect Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-11510 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands. Vendor: Ivanti Product: Pulse Connect Secure and Pulse Policy Secure Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-11539 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1906 Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1906 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-1905 Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously. Vendor: Qualcomm Product: Multiple Chipsets Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-1905 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10221 rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter. Vendor: rConfig Product: rConfig Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10221 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35395 Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS). Vendor: Realtek Product: AP-Router SDK Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-35395 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-16651 Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. Vendor: Roundcube Product: Roundcube Webmail Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-16651 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11652 SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. Vendor: SaltStack Product: Salt Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-11652 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11651 SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. Vendor: SaltStack Product: Salt Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-11651 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-16846 SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API. Vendor: SaltStack Product: Salt Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-16846 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-2380 SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users. Vendor: SAP Product: Customer Relationship Management (CRM) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-2380 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2010-5326 SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2010-5326 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-9563 SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-9563 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6287 SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-6287 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-6207 SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager. Vendor: SAP Product: Solution Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-6207 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3976 SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. Vendor: SAP Product: NetWeaver Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-3976 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16256 SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message. Vendor: SIMalliance Product: Toolbox Browser Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-16256 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10148 SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. Vendor: SolarWinds Product: Orion Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10148 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-35211 SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution. Vendor: SolarWinds Product: Serv-U Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-35211 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2016-3643 SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. Vendor: SolarWinds Product: Virtualization Manager Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2016-3643 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10199 Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution. Vendor: Sonatype Product: Nexus Repository Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10199 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20021 SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation. Vendor: SonicWall Product: SonicWall Email Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-20021 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-7481 SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources. Vendor: SonicWall Product: SMA100 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-7481 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20022 SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation. Vendor: SonicWall Product: SonicWall Email Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-20022 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20023 SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation. Vendor: SonicWall Product: SonicWall Email Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-20023 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-20016 SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. Vendor: SonicWall Product: SSLVPN SMA100 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-20016 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-12271 Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords). Vendor: Sophos Product: SFOS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-12271 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10181 Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device. Vendor: Sumavision Product: Enhanced Multimedia Router (EMR) Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10181 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-6327 Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions. Vendor: Symantec Product: Symantec Messaging Gateway Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-6327 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-18988 TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system). Vendor: TeamViewer Product: Desktop Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-18988 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files. Vendor: Progress Product: ASP.NET AJAX and Sitefinity Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2017-9248 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-31755 Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request. Vendor: Tenda Product: AC11 Router Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-31755 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10987 Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter. Vendor: Tenda Product: AC1900 Router AC15 Model Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10987 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-14558 Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request. Vendor: Tenda Product: AC7, AC9, and AC10 Routers Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-14558 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2018-20062 ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter. Vendor: ThinkPHP Product: noneCms Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2018-20062 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9082 ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command. Vendor: ThinkPHP Product: ThinkPHP Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-9082 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-18187 Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution. Vendor: Trend Micro Product: OfficeScan Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-18187 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8467 Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution. Vendor: Trend Micro Product: Apex One and OfficeScan Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8467 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8468 Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components. Vendor: Trend Micro Product: Apex One, OfficeScan and Worry-Free Business Security Agents Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8468 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-24557 Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation. Vendor: Trend Micro Product: Apex One, OfficeScan, and Worry-Free Business Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-24557 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-8599 Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login. Vendor: Trend Micro Product: Apex One and OfficeScan Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-8599 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36742 Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation. Vendor: Trend Micro Product: Apex One, Apex One as a Service, and Worry-Free Business Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-36742 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-36741 Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files. Vendor: Trend Micro Product: Apex One, Apex One as a Service, and Worry-Free Business Security Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-36741 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-20085 TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests. Vendor: TVT Product: NVMS-1000 Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-20085 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5849 Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution. Vendor: Unraid Product: Unraid Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-5849 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-5847 Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access. Vendor: Unraid Product: Unraid Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-5847 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-16759 The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. Vendor: vBulletin Product: vBulletin Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-16759 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-17496 The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759. Vendor: vBulletin Product: vBulletin Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-17496 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-5544 VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution. Vendor: VMware Product: VMware ESXi and Horizon DaaS Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-5544 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3992 VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution. Vendor: VMware Product: ESXi Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3992 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3950 VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. Vendor: VMware Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3950 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-22005 VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-22005 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-3952 VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-3952 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21972 VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21972 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-21985 VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution. Vendor: VMware Product: vCenter Server Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-21985 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-4006 VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system. Vendor: VMware Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-4006 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-25213 WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site. Vendor: WordPress Product: File Manager Plugin Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-25213 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-11738 WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. Vendor: WordPress Product: Snap Creek Duplicator Plugin Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-11738 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-9978 WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro. Vendor: WordPress Product: Social Warfare Plugin Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-9978 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-27561 Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution. Vendor: Yealink Product: Device Management Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-27561 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2021-40539 Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2021-11-17 Known ransomware use: Known Wed, 03 Nov 2021 00:00:00 +0000 CVE-2021-40539 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-10189 Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-10189 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2019-8394 Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization. Vendor: Zoho Product: ManageEngine Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2019-8394 CISA KEV https://nvd.nist.gov/vuln/detail/CVE-2020-29583 Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password. Vendor: Zyxel Product: Multiple Products Added to CISA KEV: 2021-11-03 CISA required action: Apply updates per vendor instructions. Federal due date: 2022-05-03 Known ransomware use: Unknown Wed, 03 Nov 2021 00:00:00 +0000 CVE-2020-29583 CISA KEV