CISA KEV Catalog

Ahsay AhsayCBS — Ahsay AhsayCBS Command Injection Vulnerability

Cisco Secure Email Gateway — Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Ahsay AhsayCBS — Ahsay AhsayCBS Improper Authentication Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Code Injection Vulnerability

Ivanti Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Microsoft Windows — Microsoft Windows Command Injection Vulnerability

ISC BIND — ISC BIND Data Processing Errors Vulnerability

Apache Struts — Apache Struts Command Injection Vulnerability

Strapi Strapi — Strapi Cleartext Storage of Sensitive Information Vulnerability

ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability

ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability

Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Zammad GmbH Zammad — Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad — Zammad GmbH Zammad Session Fixation Vulnerability

Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Apple Multiple Products — Apple Multiple Products Out-of-Bounds Write Vulnerability

Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler — Citrix NetScaler Improper Input Validation Vulnerability

MikroTik RouterOS — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Microsoft SharePoint — Microsoft SharePoint Code Injection Vulnerability

WordPress Core — WordPress Core Remote File Inclusion Vulnerability

WSO2 Multiple Products — WSO2 Multiple Products Path Traversal Vulnerability

Adobe Commerce and Magento — Adobe Commerce and Magento Incorrect Authorization Vulnerability

Arista VeloCloud Orchestrator — Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

F5 BIG-IP APM — F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Check Point Multiple Products — Check Point Multiple Products Path Traversal Vulnerability

Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability

Zyxel GS1900 Series Switches — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Linux Kernel — Linux Kernel Race Condition Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Write Vulnerability

Linux Kernel — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

Google Pixel — Google Pixel Improper Authorization Vulnerability

Cisco Identity Services Engine — Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Acronis Backup — Acronis Backup Incorrect Default Permissions Vulnerability

Cisco Secure Email Gateway — Cisco Secure Email Gateway SQL Injection Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

JFrog Artifactory — JFrog Artifactory Incorrect Authorization Vulnerability

JFrog Artifactory — JFrog Artifactory Improper Authentication Vulnerability

GitLab Community Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

MikroTik RouterOS — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik RouterOS — MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

Citrix NetScaler — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Out of Bounds Write Vulnerability

Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management — Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Adobe Commerce and Magento — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Microsoft Windows — Microsoft Windows Link Following Vulnerability

N-able N-central — N-able N-central Static Code Injection Vulnerability

Microsoft Windows — Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

BerriAI LiteLLM — BerriAI LiteLLM Improper Authentication Vulnerability

Kludex Starlette — Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kestra Kestra OSS — Kestra OSS OS Command Injection Vulnerability

JFrog Artifactory — JFrog Artifactory Improper Authentication Vulnerability

Sangoma Switchvox — Sangoma Switchvox SQL Injection Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances OS Command Injection Vulnerability

PaperCut NG/MF — PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF — PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

ownCloud ownCloud — ownCloud Improper Authentication Vulnerability

Linux Kernel — Linux Kernel Unspecified Vulnerability

JFrog Artifactory — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Ajax.NET Professional Ajax.NET Professional — Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Red Hat Libuser — Red Hat Libuser Race Condition Vulnerability

Red Hat Automatic Bug Reporting Tool — Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Write Vulnerability

Citrix NetScaler ADC and NetScaler Gateway — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Microsoft SQL Server — Microsoft SQL Server Remote Code Execution Vulnerability

Gitea Gitea — Gitea Code Injection Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

TrueConf Server — TrueConf Server Code Injection Vulnerability

TrueConf Server — TrueConf Server Missing Authentication for Critical Function Vulnerability

MLflow MLflow — MLflow Server-Side Request Forgery Vulnerability

Microsoft Internet Key Exchange (IKE) Service Extensions — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Broadcom VMware vCenter — Broadcom VMware vCenter Path Traversal Vulnerability

Microsoft SharePoint — Microsoft SharePoint Weak Authentication Vulnerability

Apple macOS — Apple macOS Improper Authentication Vulnerability

Ray-Project Ray — Ray-Project Ray Code Injection Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Metabase Metabase — Metabase SQL Injection Vulnerability

Progress LoadMaster — Progress LoadMaster Command Injection Vulnerability

JetBrains TeamCity — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

N-able N-central — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Apache Tomcat — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

IBM Langflow — IBM Langflow Code Injection Vulnerability

N-able N-central — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Fortinet FortiOS — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Arista VeloCloud Orchestrator — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Check Point SmartConsole — Check Point SmartConsole Improper Authentication Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

WordPress Core — WordPress Core SQL Injection Vulnerability

WordPress Core — WordPress Core Interpretation Conflict Vulnerability

Langflow Langflow — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

DD-WRT DD-WRT — DD-WRT Stack-Based Buffer Overflow Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Fortinet FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Improper Privilege Management Vulnerability

KNX Association KNX Protocol Connection Authorization Option 1 — KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability

Microsoft Active Directory Federation Services — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Microsoft SharePoint Server — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Code Injection Vulnerability

Cisco IOS — Cisco IOS Cross-Site Request Forgery Vulnerability

Balbooa Forms — Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda iCagenda — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

JoomShaper SP Page Builder — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Langflow Langflow — Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Joomlack Page Builder — Joomlack Page Builder Improper Access Control Vulnerability

Adobe ColdFusion — Adobe ColdFusion Path Traversal Vulnerability

Microsoft SharePoint Server — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Authentication Bypass Vulnerability

PTC Windchill and FlexPLM — PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Lantronix EDS5000 — Lantronix EDS5000 Code Injection Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Access Control Vulnerability

Splunk Enterprise — Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Widget Factory Joomla Content Editor — Widget Factory Joomla Content Editor Improper Access Control Vulnerability

LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Ivanti Sentry — Ivanti Sentry OS Command Injection Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Arista Extensible Operating System — Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

BerriAI LiteLLM — BerriAI LiteLLM Command Injection Vulnerability

Check Point Security Gateway — Check Point Security Gateway Improper Authentication Vulnerability

SolarWinds Serv-U — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

Mirasvit Mirasvit Full Page Cache Warmer — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Linux Kernel — Linux Kernel Improper Authentication Vulnerability

Android Framework — Android Framework Integer Overflow Vulnerability

Oracle WebLogic Server — Oracle WebLogic Server Unspecified Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Nx Nx Console — Nx Console Embedded Malicious Code Vulnerability

TanStack TanStack — TanStack Unspecified Vulnerability

Daemon Daemon Tools Lite — Daemon Tools Lite Embedded Malicious Code Vulnerability

LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

Drupal Core — Drupal Core SQL Injection Vulnerability

Langflow Langflow — Langflow Origin Validation Error Vulnerability

Trend Micro Apex One — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Microsoft Windows — Microsoft Windows Buffer Overflow Vulnerability

Microsoft DirectX — Microsoft DirectX NULL Byte Overwrite Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Defender — Microsoft Defender Link Following Vulnerability

Microsoft Defender — Microsoft Defender Denial of Service Vulnerability

Microsoft Microsoft — Microsoft Exchange Server Cross-Site Scripting Vulnerability

Cisco Catalyst SD-WAN — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Linux Kernel — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Protection Mechanism Failure Vulnerability

D-Link DIR-823X — D-Link DIR-823X Command Injection Vulnerability

Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Path Traversal Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Missing Authorization Vulnerability

Marimo Marimo — Marimo Remote Code Execution Vulnerability

Microsoft Defender — Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Cisco Catalyst SD-WAN Manger — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Kentico Kentico Xperience — Kentico Xperience Path Traversal Vulnerability

PaperCut NG/MF — PaperCut NG/MF Improper Authentication Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Quest KACE Systems Management Appliance (SMA) — Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

JetBrains TeamCity — JetBrains TeamCity Relative Path Traversal Vulnerability

Apache ActiveMQ — Apache ActiveMQ Improper Input Validation Vulnerability

Microsoft Office — Microsoft Office Remote Code Execution

Microsoft SharePoint Server — Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft Visual Basic for Applications (VBA) — Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Windows — Microsoft Windows Link Following Vulnerability

Microsoft Exchange Server — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Windows — Microsoft Windows Out-of-Bounds Read Vulnerability

Adobe Acrobat — Adobe Acrobat Use-After-Free Vulnerability

Fortinet FortiClient EMS — Fortinet FortiClient EMS SQL Injection Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Prototype Pollution Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Fortinet FortiClient EMS — Fortinet FortiClient EMS Improper Access Control Vulnerability

TrueConf Client — TrueConf Client Download of Code Without Integrity Check Vulnerability

Google Dawn — Google Dawn Use-After-Free Vulnerability

Citrix NetScaler — Citrix NetScaler Out-of-Bounds Read Vulnerability

F5 BIG-IP — F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Aquasecurity Trivy — Aquasecurity Trivy Embedded Malicious Code Vulnerability

Langflow Langflow — Langflow Code Injection Vulnerability

Craft CMS Craft CMS — Craft CMS Code Injection Vulnerability

Laravel Livewire — Laravel Livewire Code Injection Vulnerability

Apple Multiple Products — Apple Multiple Products Improper Locking Vulnerability

Apple Multiple Products — Apple Multiple Products Classic Buffer Overflow Vulnerability

Apple Multiple Products — Apple Multiple Products Buffer Overflow Vulnerability

Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Wing FTP Server Wing FTP Server — Wing FTP Server Information Disclosure Vulnerability

Google Chromium V8 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

Google Skia — Google Skia Out-of-Bounds Write Vulnerability

n8n n8n — n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Omnissa Workspace One UEM — Omnissa Workspace ONE Server-Side Request Forgery

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Ivanti Endpoint Manager (EPM) — Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Hikvision Multiple Products — Hikvision Multiple Products Improper Authentication Vulnerability

Rockwell Multiple Products — Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Apple Multiple Products — Apple Multiple products Use-After-Free Vulnerability

Apple Multiple Products — Apple Multiple Products Integer Overflow or Wraparound Vulnerability

Apple iOS and iPadOS — Apple iOS and iPadOS Use-After-Free Vulnerability

Broadcom VMware Aria Operations — Broadcom VMware Aria Operations Command Injection Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Memory Corruption Vulnerability

Cisco SD-WAN — Cisco SD-WAN Path Traversal Vulnerability

Cisco Catalyst SD-WAN Controller and Manager — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Soliton Systems K.K FileZen — Soliton Systems K.K FileZen OS Command Injection Vulnerability

Roundcube Webmail — RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail — RoundCube Webmail Cross-site Scripting Vulnerability

GitLab GitLab — GitLab Server-Side Request Forgery (SSRF) Vulnerability

Dell RecoverPoint for Virtual Machines (RP4VMs) — Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Synacor Zimbra Collaboration Suite — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

TeamT5 ThreatSonar Anti-Ransomware — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

Microsoft Windows — Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

Google Chromium — Google Chromium CSS Use-After-Free Vulnerability

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Buffer Overflow Vulnerability

Microsoft Configuration Manager — Microsoft Configuration Manager SQL Injection Vulnerability

Notepad++ Notepad++ — Notepad++ Download of Code Without Integrity Check Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Security Control Bypass Vulnerability

Microsoft Windows — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Microsoft Windows — Microsoft Windows NULL Pointer Dereference Vulnerability

Microsoft Windows — Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Microsoft Windows — Microsoft Windows Improper Privilege Management Vulnerability

Microsoft Windows — Microsoft Windows Type Confusion Vulnerability

Microsoft Office — Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

React Native Community CLI — React Native Community CLI OS Command Injection Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

GitLab Community and Enterprise Editions — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

Sangoma FreePBX — Sangoma FreePBX OS Command Injection Vulnerability

Sangoma FreePBX — Sangoma FreePBX Improper Authentication Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Linux Kernel — Linux Kernel Integer Overflow Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

GNU InetUtils — GNU InetUtils Argument Injection Vulnerability

Microsoft Office — Microsoft Office Security Feature Bypass Vulnerability

Broadcom VMware vCenter Server — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Versa Concerto — Versa Concerto Improper Authentication Vulnerability

Vite Vitejs — Vite Vitejs Improper Access Control Vulnerability

Prettier eslint-config-prettier — Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Cisco Unified Communications Manager — Cisco Unified Communications Products Code Injection Vulnerability

Microsoft Windows — Microsoft Windows Information Disclosure Vulnerability

Gogs Gogs — Gogs Path Traversal Vulnerability

Microsoft Office — Microsoft Office PowerPoint Code Injection Vulnerability

Hewlett Packard Enterprise (HPE) OneView — Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

MongoDB MongoDB and MongoDB Server — MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

Digiever DS-2105 Pro — Digiever DS-2105 Pro Missing Authorization Vulnerability

WatchGuard Firebox — WatchGuard Firebox Out of Bounds Write Vulnerability

ASUS Live Update — ASUS Live Update Embedded Malicious Code Vulnerability

SonicWall SMA1000 appliance — SonicWall SMA1000 Missing Authorization Vulnerability

Cisco Multiple Products — Cisco Multiple Products Improper Input Validation Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Gladinet CentreStack and Triofox — Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Apple Multiple Products — Apple Multiple Products Use-After-Free WebKit Vulnerability

Sierra Wireless AirLink ALEOS — Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Google Chromium — Google Chromium Out of Bounds Memory Access Vulnerability

OSGeo GeoServer — OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Use After Free Vulnerability

D-Link Routers — D-Link Routers Buffer Overflow Vulnerability

Array Networks ArrayOS AG — Array Networks ArrayOS AG OS Command Injection Vulnerability

Meta React Server Components — Meta React Server Components Remote Code Execution Vulnerability

OpenPLC ScadaBR — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Android Framework — Android Framework Information Disclosure Vulnerability

Android Framework — Android Framework Privilege Escalation Vulnerability

OpenPLC ScadaBR — OpenPLC ScadaBR Cross-site Scripting Vulnerability

Oracle Fusion Middleware — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb Path Traversal Vulnerability

Gladinet Triofox — Gladinet Triofox Improper Access Control Vulnerability

Microsoft Windows — Microsoft Windows Race Condition Vulnerability

WatchGuard Firebox — WatchGuard Firebox Out-of-Bounds Write Vulnerability

Samsung Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CWP Control Web Panel — CWP Control Web Panel OS Command Injection Vulnerability

Gladinet CentreStack and Triofox — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Broadcom VMware Aria Operations and VMware Tools — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

XWiki Platform — XWiki Platform Eval Injection Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

Adobe Commerce and Magento — Adobe Commerce and Magento Improper Input Validation Vulnerability

Microsoft Windows — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Motex LANSCOPE Endpoint Manager — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Apple Multiple Products — Apple Multiple Products Unspecified Vulnerability

Kentico Xperience CMS — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico Xperience CMS — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Microsoft Windows — Microsoft Windows SMB Client Improper Access Control Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Adobe Experience Manager (AEM) Forms — Adobe Experience Manager Forms Code Execution Vulnerability

IGEL IGEL OS — IGEL OS Use of a Key Past its Expiration Date Vulnerability

Microsoft Windows — Microsoft Windows Untrusted Pointer Dereference Vulnerability

Microsoft Windows — Microsoft Windows Improper Access Control Vulnerability

SKYSEA Client View — SKYSEA Client View Improper Authentication Vulnerability

Grafana Labs Grafana — Grafana Path Traversal Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Linux Kernel — Linux Kernel Heap Out-of-Bounds Write Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft Windows — Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Out-of-Bounds Write Vulnerability

Microsoft Windows — Microsoft Windows Remote Code Execution Vulnerability

Mozilla Multiple Products — Mozilla Multiple Products Remote Code Execution Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Unspecified Vulnerability

GNU GNU Bash — GNU Bash OS Command Injection Vulnerability

Jenkins Jenkins — Jenkins Remote Code Execution Vulnerability

Juniper ScreenOS — Juniper ScreenOS Improper Authentication Vulnerability

Samsung Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Smartbedded Meteobridge — Smartbedded Meteobridge Command Injection Vulnerability

Sudo Sudo — Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Libraesva Email Security Gateway — Libraesva Email Security Gateway Command Injection Vulnerability

Fortra GoAnywhere MFT — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Cisco IOS and IOS XE — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Adminer Adminer — Adminer Server-Side Request Forgery Vulnerability

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Linux Kernel — Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Android Runtime — Android Runtime Use-After-Free Vulnerability

Sitecore Multiple Products — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

TP-Link TL-WR841N — TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

TP-Link Multiple Routers — TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link TL-WA855RE — TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

Meta Platforms WhatsApp — Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Sangoma FreePBX — Sangoma FreePBX Authentication Bypass Vulnerability

Citrix NetScaler — Citrix NetScaler Memory Overflow Vulnerability

Git Git — Git Link Following Vulnerability

Citrix Session Recording — Citrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording — Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Apple iOS, iPadOS, and macOS — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Trend Micro Apex One — Trend Micro Apex One OS Command Injection Vulnerability

N-able N-Central — N-able N-Central Command Injection Vulnerability

N-able N-Central — N-able N-Central Insecure Deserialization Vulnerability

RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability

Microsoft Office — Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft Internet Explorer — Microsoft Internet Explorer Resource Management Errors Vulnerability

D-Link DCS-2530L and DCS-2670L Devices — D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link DCS-2530L and DCS-2670L Devices — D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link DNR-322L — D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

PaperCut NG/MF — PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

Cisco Identity Services Engine — Cisco Identity Services Engine Injection Vulnerability

Cisco Identity Services Engine — Cisco Identity Services Engine Injection Vulnerability

SysAid SysAid On-Prem — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid SysAid On-Prem — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Google Chromium — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

CrushFTP CrushFTP — CrushFTP Unprotected Alternate Channel Vulnerability

Microsoft SharePoint — Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint — Microsoft SharePoint Improper Authentication Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb SQL Injection Vulnerability

Wing FTP Server Wing FTP Server — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Citrix NetScaler ADC and Gateway — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Rails Ruby on Rails — Rails Ruby on Rails Path Traversal Vulnerability

PHP PHPMailer — PHPMailer Command Injection Vulnerability

Looking Glass Multi-Router Looking Glass (MRLG) — Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

TeleMessage TM SGNL — TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

TeleMessage TM SGNL — TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Citrix NetScaler ADC and Gateway — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Fortinet FortiOS — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

D-Link DIR-859 Router — D-Link DIR-859 Router Path Traversal Vulnerability

AMI MegaRAC SPx — AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Linux Kernel — Linux Kernel Improper Ownership Management Vulnerability

TP-Link Multiple Routers — TP-Link Multiple Routers Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Products Unspecified Vulnerability

Microsoft Windows — Microsoft Windows External Control of File Name or Path Vulnerability

Wazuh Wazuh Server — Wazuh Server Deserialization of Untrusted Data Vulnerability

Roundcube Webmail — RoundCube Webmail Cross-Site Scripting Vulnerability

Erlang Erlang/OTP — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Use-After-Free Vulnerability

ASUS Routers — ASUS Routers Improper Authentication Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Improper Authentication Vulnerability

Craft CMS Craft CMS — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS Craft CMS — Craft CMS Code Injection Vulnerability

ASUS RT-AX55 Routers — ASUS RT-AX55 Routers OS Command Injection Vulnerability

Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability

ZKTeco BioTime — ZKTeco BioTime Path Traversal Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Srimax Output Messenger — Srimax Output Messenger Directory Traversal Vulnerability

MDaemon Email Server — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability