CISA KEV Catalog

Balbooa Forms — Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda iCagenda — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

JoomShaper SP Page Builder — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Langflow Langflow — Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Joomlack Page Builder — Joomlack Page Builder Improper Access Control Vulnerability

Adobe ColdFusion — Adobe ColdFusion Path Traversal Vulnerability

Microsoft SharePoint Server — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Authentication Bypass Vulnerability

PTC Windchill and FlexPLM — PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Lantronix EDS5000 — Lantronix EDS5000 Code Injection Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Access Control Vulnerability

Splunk Enterprise — Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Widget Factory Joomla Content Editor — Widget Factory Joomla Content Editor Improper Access Control Vulnerability

LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Ivanti Sentry — Ivanti Sentry OS Command Injection Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Arista Extensible Operating System — Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

BerriAI LiteLLM — BerriAI LiteLLM Command Injection Vulnerability

Check Point Security Gateway — Check Point Security Gateway Improper Authentication Vulnerability

SolarWinds Serv-U — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

Mirasvit Mirasvit Full Page Cache Warmer — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Linux Kernel — Linux Kernel Improper Authentication Vulnerability

Android Framework — Android Framework Integer Overflow Vulnerability

Oracle WebLogic Server — Oracle WebLogic Server Unspecified Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Nx Nx Console — Nx Console Embedded Malicious Code Vulnerability

TanStack TanStack — TanStack Unspecified Vulnerability

Daemon Daemon Tools Lite — Daemon Tools Lite Embedded Malicious Code Vulnerability

LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

Drupal Core — Drupal Core SQL Injection Vulnerability

Langflow Langflow — Langflow Origin Validation Error Vulnerability

Trend Micro Apex One — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Microsoft Windows — Microsoft Windows Buffer Overflow Vulnerability

Microsoft DirectX — Microsoft DirectX NULL Byte Overwrite Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Defender — Microsoft Defender Link Following Vulnerability

Microsoft Defender — Microsoft Defender Denial of Service Vulnerability

Microsoft Microsoft — Microsoft Exchange Server Cross-Site Scripting Vulnerability

Cisco Catalyst SD-WAN — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Linux Kernel — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Protection Mechanism Failure Vulnerability

D-Link DIR-823X — D-Link DIR-823X Command Injection Vulnerability

Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Path Traversal Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Missing Authorization Vulnerability

Marimo Marimo — Marimo Remote Code Execution Vulnerability

Microsoft Defender — Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Cisco Catalyst SD-WAN Manger — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Kentico Kentico Xperience — Kentico Xperience Path Traversal Vulnerability

PaperCut NG/MF — PaperCut NG/MF Improper Authentication Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Quest KACE Systems Management Appliance (SMA) — Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

JetBrains TeamCity — JetBrains TeamCity Relative Path Traversal Vulnerability

Apache ActiveMQ — Apache ActiveMQ Improper Input Validation Vulnerability

Microsoft Office — Microsoft Office Remote Code Execution

Microsoft SharePoint Server — Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft Visual Basic for Applications (VBA) — Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Windows — Microsoft Windows Link Following Vulnerability

Microsoft Exchange Server — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Windows — Microsoft Windows Out-of-Bounds Read Vulnerability

Adobe Acrobat — Adobe Acrobat Use-After-Free Vulnerability

Fortinet FortiClient EMS — Fortinet FortiClient EMS SQL Injection Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Prototype Pollution Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Fortinet FortiClient EMS — Fortinet FortiClient EMS Improper Access Control Vulnerability

TrueConf Client — TrueConf Client Download of Code Without Integrity Check Vulnerability

Google Dawn — Google Dawn Use-After-Free Vulnerability

Citrix NetScaler — Citrix NetScaler Out-of-Bounds Read Vulnerability

F5 BIG-IP — F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Aquasecurity Trivy — Aquasecurity Trivy Embedded Malicious Code Vulnerability

Langflow Langflow — Langflow Code Injection Vulnerability

Craft CMS Craft CMS — Craft CMS Code Injection Vulnerability

Laravel Livewire — Laravel Livewire Code Injection Vulnerability

Apple Multiple Products — Apple Multiple Products Improper Locking Vulnerability

Apple Multiple Products — Apple Multiple Products Classic Buffer Overflow Vulnerability

Apple Multiple Products — Apple Multiple Products Buffer Overflow Vulnerability

Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Wing FTP Server Wing FTP Server — Wing FTP Server Information Disclosure Vulnerability

Google Chromium V8 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

Google Skia — Google Skia Out-of-Bounds Write Vulnerability

n8n n8n — n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Omnissa Workspace One UEM — Omnissa Workspace ONE Server-Side Request Forgery

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Ivanti Endpoint Manager (EPM) — Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Hikvision Multiple Products — Hikvision Multiple Products Improper Authentication Vulnerability

Rockwell Multiple Products — Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Apple Multiple Products — Apple Multiple products Use-After-Free Vulnerability

Apple Multiple Products — Apple Multiple Products Integer Overflow or Wraparound Vulnerability

Apple iOS and iPadOS — Apple iOS and iPadOS Use-After-Free Vulnerability

Broadcom VMware Aria Operations — Broadcom VMware Aria Operations Command Injection Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Memory Corruption Vulnerability

Cisco SD-WAN — Cisco SD-WAN Path Traversal Vulnerability

Cisco Catalyst SD-WAN Controller and Manager — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Soliton Systems K.K FileZen — Soliton Systems K.K FileZen OS Command Injection Vulnerability

Roundcube Webmail — RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail — RoundCube Webmail Cross-site Scripting Vulnerability

GitLab GitLab — GitLab Server-Side Request Forgery (SSRF) Vulnerability

Dell RecoverPoint for Virtual Machines (RP4VMs) — Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Synacor Zimbra Collaboration Suite — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

TeamT5 ThreatSonar Anti-Ransomware — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

Microsoft Windows — Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

Google Chromium — Google Chromium CSS Use-After-Free Vulnerability

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Buffer Overflow Vulnerability

Microsoft Configuration Manager — Microsoft Configuration Manager SQL Injection Vulnerability

Notepad++ Notepad++ — Notepad++ Download of Code Without Integrity Check Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Security Control Bypass Vulnerability

Microsoft Windows — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Microsoft Windows — Microsoft Windows NULL Pointer Dereference Vulnerability

Microsoft Windows — Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Microsoft Windows — Microsoft Windows Improper Privilege Management Vulnerability

Microsoft Windows — Microsoft Windows Type Confusion Vulnerability

Microsoft Office — Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

React Native Community CLI — React Native Community CLI OS Command Injection Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

GitLab Community and Enterprise Editions — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

Sangoma FreePBX — Sangoma FreePBX OS Command Injection Vulnerability

Sangoma FreePBX — Sangoma FreePBX Improper Authentication Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Linux Kernel — Linux Kernel Integer Overflow Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

GNU InetUtils — GNU InetUtils Argument Injection Vulnerability

Microsoft Office — Microsoft Office Security Feature Bypass Vulnerability

Broadcom VMware vCenter Server — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Versa Concerto — Versa Concerto Improper Authentication Vulnerability

Vite Vitejs — Vite Vitejs Improper Access Control Vulnerability

Prettier eslint-config-prettier — Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Cisco Unified Communications Manager — Cisco Unified Communications Products Code Injection Vulnerability

Microsoft Windows — Microsoft Windows Information Disclosure Vulnerability

Gogs Gogs — Gogs Path Traversal Vulnerability

Microsoft Office — Microsoft Office PowerPoint Code Injection Vulnerability

Hewlett Packard Enterprise (HPE) OneView — Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

MongoDB MongoDB and MongoDB Server — MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

Digiever DS-2105 Pro — Digiever DS-2105 Pro Missing Authorization Vulnerability

WatchGuard Firebox — WatchGuard Firebox Out of Bounds Write Vulnerability

ASUS Live Update — ASUS Live Update Embedded Malicious Code Vulnerability

SonicWall SMA1000 appliance — SonicWall SMA1000 Missing Authorization Vulnerability

Cisco Multiple Products — Cisco Multiple Products Improper Input Validation Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Gladinet CentreStack and Triofox — Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Apple Multiple Products — Apple Multiple Products Use-After-Free WebKit Vulnerability

Sierra Wireless AirLink ALEOS — Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Google Chromium — Google Chromium Out of Bounds Memory Access Vulnerability

OSGeo GeoServer — OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Use After Free Vulnerability

D-Link Routers — D-Link Routers Buffer Overflow Vulnerability

Array Networks ArrayOS AG — Array Networks ArrayOS AG OS Command Injection Vulnerability

Meta React Server Components — Meta React Server Components Remote Code Execution Vulnerability

OpenPLC ScadaBR — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Android Framework — Android Framework Information Disclosure Vulnerability

Android Framework — Android Framework Privilege Escalation Vulnerability

OpenPLC ScadaBR — OpenPLC ScadaBR Cross-site Scripting Vulnerability

Oracle Fusion Middleware — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb Path Traversal Vulnerability

Gladinet Triofox — Gladinet Triofox Improper Access Control Vulnerability

Microsoft Windows — Microsoft Windows Race Condition Vulnerability

WatchGuard Firebox — WatchGuard Firebox Out-of-Bounds Write Vulnerability

Samsung Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CWP Control Web Panel — CWP Control Web Panel OS Command Injection Vulnerability

Gladinet CentreStack and Triofox — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Broadcom VMware Aria Operations and VMware Tools — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

XWiki Platform — XWiki Platform Eval Injection Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

Adobe Commerce and Magento — Adobe Commerce and Magento Improper Input Validation Vulnerability

Microsoft Windows — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Motex LANSCOPE Endpoint Manager — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Apple Multiple Products — Apple Multiple Products Unspecified Vulnerability

Kentico Xperience CMS — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico Xperience CMS — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Microsoft Windows — Microsoft Windows SMB Client Improper Access Control Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Adobe Experience Manager (AEM) Forms — Adobe Experience Manager Forms Code Execution Vulnerability

IGEL IGEL OS — IGEL OS Use of a Key Past its Expiration Date Vulnerability

Microsoft Windows — Microsoft Windows Untrusted Pointer Dereference Vulnerability

Microsoft Windows — Microsoft Windows Improper Access Control Vulnerability

SKYSEA Client View — SKYSEA Client View Improper Authentication Vulnerability

Grafana Labs Grafana — Grafana Path Traversal Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Linux Kernel — Linux Kernel Heap Out-of-Bounds Write Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft Windows — Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Out-of-Bounds Write Vulnerability

Microsoft Windows — Microsoft Windows Remote Code Execution Vulnerability

Mozilla Multiple Products — Mozilla Multiple Products Remote Code Execution Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Unspecified Vulnerability

GNU GNU Bash — GNU Bash OS Command Injection Vulnerability

Jenkins Jenkins — Jenkins Remote Code Execution Vulnerability

Juniper ScreenOS — Juniper ScreenOS Improper Authentication Vulnerability

Samsung Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Smartbedded Meteobridge — Smartbedded Meteobridge Command Injection Vulnerability

Sudo Sudo — Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Libraesva Email Security Gateway — Libraesva Email Security Gateway Command Injection Vulnerability

Fortra GoAnywhere MFT — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Cisco IOS and IOS XE — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Adminer Adminer — Adminer Server-Side Request Forgery Vulnerability

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Linux Kernel — Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Android Runtime — Android Runtime Use-After-Free Vulnerability

Sitecore Multiple Products — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

TP-Link TL-WR841N — TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

TP-Link Multiple Routers — TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link TL-WA855RE — TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

Meta Platforms WhatsApp — Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Sangoma FreePBX — Sangoma FreePBX Authentication Bypass Vulnerability

Citrix NetScaler — Citrix NetScaler Memory Overflow Vulnerability

Git Git — Git Link Following Vulnerability

Citrix Session Recording — Citrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording — Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Apple iOS, iPadOS, and macOS — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Trend Micro Apex One — Trend Micro Apex One OS Command Injection Vulnerability

N-able N-Central — N-able N-Central Command Injection Vulnerability

N-able N-Central — N-able N-Central Insecure Deserialization Vulnerability

RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability

Microsoft Office — Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Resource Management Errors Vulnerability

D-Link DCS-2530L and DCS-2670L Devices — D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link DCS-2530L and DCS-2670L Devices — D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link DNR-322L — D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

PaperCut NG/MF — PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

Cisco Identity Services Engine — Cisco Identity Services Engine Injection Vulnerability

Cisco Identity Services Engine — Cisco Identity Services Engine Injection Vulnerability

SysAid SysAid On-Prem — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid SysAid On-Prem — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Google Chromium — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

CrushFTP CrushFTP — CrushFTP Unprotected Alternate Channel Vulnerability

Microsoft SharePoint — Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint — Microsoft SharePoint Improper Authentication Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb SQL Injection Vulnerability

Wing FTP Server Wing FTP Server — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Citrix NetScaler ADC and Gateway — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Rails Ruby on Rails — Rails Ruby on Rails Path Traversal Vulnerability

PHP PHPMailer — PHPMailer Command Injection Vulnerability

Looking Glass Multi-Router Looking Glass (MRLG) — Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

TeleMessage TM SGNL — TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

TeleMessage TM SGNL — TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Citrix NetScaler ADC and Gateway — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Fortinet FortiOS — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

D-Link DIR-859 Router — D-Link DIR-859 Router Path Traversal Vulnerability

AMI MegaRAC SPx — AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Linux Kernel — Linux Kernel Improper Ownership Management Vulnerability

TP-Link Multiple Routers — TP-Link Multiple Routers Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Products Unspecified Vulnerability

Microsoft Windows — Microsoft Windows External Control of File Name or Path Vulnerability

Wazuh Wazuh Server — Wazuh Server Deserialization of Untrusted Data Vulnerability

Roundcube Webmail — RoundCube Webmail Cross-Site Scripting Vulnerability

Erlang Erlang/OTP — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Use-After-Free Vulnerability

ASUS Routers — ASUS Routers Improper Authentication Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Improper Authentication Vulnerability

Craft CMS Craft CMS — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS Craft CMS — Craft CMS Code Injection Vulnerability

ASUS RT-AX55 Routers — ASUS RT-AX55 Routers OS Command Injection Vulnerability

Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability

ZKTeco BioTime — ZKTeco BioTime Path Traversal Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Srimax Output Messenger — Srimax Output Messenger Directory Traversal Vulnerability

MDaemon Email Server — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

SAP NetWeaver — SAP NetWeaver Deserialization Vulnerability

DrayTek Vigor Routers — DrayTek Vigor Routers OS Command Injection Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Microsoft Windows — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Scripting Engine Type Confusion Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows DWM Core Library Use-After-Free Vulnerability

TeleMessage TM SGNL — TeleMessage TM SGNL Hidden Functionality Vulnerability

GeoVision Multiple Devices — GeoVision Devices OS Command Injection Vulnerability

GeoVision Multiple Devices — GeoVision Devices OS Command Injection Vulnerability

FreeType FreeType — FreeType Out-of-Bounds Write Vulnerability

Langflow Langflow — Langflow Missing Authentication Vulnerability

Commvault Command Center — Commvault Command Center Path Traversal Vulnerability

Yiiframework Yii — Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Apache HTTP Server — Apache HTTP Server Improper Escaping of Output Vulnerability

SonicWall SMA100 Appliances — SonicWall SMA100 Appliances OS Command Injection Vulnerability

SAP NetWeaver — SAP NetWeaver Unrestricted File Upload Vulnerability

Broadcom Brocade Fabric OS — Broadcom Brocade Fabric OS Code Injection Vulnerability

Qualitia Active! Mail — Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Commvault Web Server — Commvault Web Server Unspecified Vulnerability

Microsoft Windows — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Apple Multiple Products — Apple Multiple Products Arbitrary Read and Write Vulnerability

Apple Multiple Products — Apple Multiple Products Memory Corruption Vulnerability

SonicWall SMA100 Appliances — SonicWall SMA100 Appliances OS Command Injection Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Read Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Access Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Gladinet CentreStack — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

CrushFTP CrushFTP — CrushFTP Authentication Bypass Vulnerability

Ivanti Connect Secure, Policy Secure, and ZTA Gateways — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Apache Tomcat — Apache Tomcat Path Equivalence Vulnerability

Cisco Smart Licensing Utility — Cisco Smart Licensing Utility Static Credential Vulnerability

Google Chromium Mojo — Google Chromium Mojo Sandbox Escape Vulnerability

Sitecore CMS and Experience Platform (XP) — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore CMS and Experience Platform (XP) — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

reviewdog action-setup GitHub Action — reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

SAP NetWeaver — SAP NetWeaver Directory Traversal Vulnerability

NAKIVO Backup and Replication — NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

Edimax IC-7100 IP Camera — Edimax IC-7100 IP Camera OS Command Injection Vulnerability

tj-actions changed-files GitHub Action — tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

Fortinet FortiOS and FortiProxy — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Juniper Junos OS — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Microsoft Windows — Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Microsoft Windows — Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Microsoft Windows — Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Microsoft Windows — Microsoft Windows NTFS Information Disclosure Vulnerability

Microsoft Windows — Microsoft Windows Win32k Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Ivanti Endpoint Manager (EPM) — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti Endpoint Manager (EPM) — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti Endpoint Manager (EPM) — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Advantive VeraCore — Advantive VeraCore Unrestricted File Upload Vulnerability

Advantive VeraCore — Advantive VeraCore SQL Injection Vulnerability

VMware ESXi, Workstation, and Fusion — VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

VMware ESXi — VMware ESXi Arbitrary Write Vulnerability

VMware ESXi and Workstation — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

Linux Kernel — Linux Kernel Use of Uninitialized Resource Vulnerability

Progress WhatsUp Gold — Progress WhatsUp Gold Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Hitachi Vantara Pentaho Business Analytics (BA) Server — Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara Pentaho Business Analytics (BA) Server — Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Cisco Small Business RV Series Routers — Cisco Small Business RV Series Routers Command Injection Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Microsoft Partner Center — Microsoft Partner Center Improper Access Control Vulnerability

Oracle Agile Product Lifecycle Management (PLM) — Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Adobe ColdFusion — Adobe ColdFusion Deserialization Vulnerability

Microsoft Power Pages — Microsoft Power Pages Improper Access Control Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS File Read Vulnerability

Craft CMS Craft CMS — Craft CMS Code Injection Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

SonicWall SonicOS — SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Path Traversal Vulnerability

Apple iOS and iPadOS — Apple iOS and iPadOS Incorrect Authorization Vulnerability

Mitel SIP Phones — Mitel SIP Phones Argument Injection Vulnerability

Zyxel DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability

Microsoft Windows — Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

Microsoft Windows — Microsoft Windows Storage Link Following Vulnerability

Trimble Cityworks — Trimble Cityworks Deserialization Vulnerability

Sophos XG Firewall — Sophos XG Firewall Buffer Overflow Vulnerability

Sophos CyberoamOS — CyberoamOS (CROS) SQL Injection Vulnerability

Microsoft Office Outlook — Microsoft Outlook Improper Input Validation Vulnerability

Audinate Dante Discovery — Dante Discovery Process Control Vulnerability

7-Zip 7-Zip — 7-Zip Mark of the Web Bypass Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Write Vulnerability

Paessler PRTG Network Monitor — Paessler PRTG Network Monitor Local File Inclusion Vulnerability

Paessler PRTG Network Monitor — Paessler PRTG Network Monitor OS Command Injection Vulnerability

Microsoft .NET Framework — Microsoft .NET Framework Information Disclosure Vulnerability

Apache OFBiz — Apache OFBiz Forced Browsing Vulnerability

Apple Multiple Products — Apple Multiple Products Use-After-Free Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Deserialization Vulnerability

JQuery JQuery — JQuery Cross-Site Scripting (XSS) Vulnerability

Aviatrix Controllers — Aviatrix Controllers OS Command Injection Vulnerability

Microsoft Windows — Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Fortinet FortiOS and FortiProxy — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Qlik Sense — Qlik Sense HTTP Tunneling Vulnerability

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

Ivanti Connect Secure, Policy Secure, and ZTA Gateways — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Oracle WebLogic Server — Oracle WebLogic Server Unspecified Vulnerability

Mitel MiCollab — Mitel MiCollab Path Traversal Vulnerability

Mitel MiCollab — Mitel MiCollab Path Traversal Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Acclaim Systems USAHERDS — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability