Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
212 results · Clear filters · Feed
-
Medium 5.5CVE-2024-27834 Exploited
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…
KEV Nov 4, 2026 -
Medium 4.3CVE-2026-118527 Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…
KEV Oct 30, 2026 -
Medium 6.5CVE-2026-96654 Exploited
Plex Media Server URL injection
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
KEV Oct 20, 2026 -
Medium 4.3
Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
KEV Oct 20, 2026 -
Medium 4.3
Plex Media Server SSRF
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
KEV Oct 20, 2026 -
Medium 6.7
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application load…
KEV Oct 20, 2026 -
Medium 5.4CVE-2025-61624 Exploited
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet Fo…
KEV Oct 16, 2026 -
Medium 6.9
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the…
KEV Sep 25, 2026 -
Medium 6.5
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuil…
KEV Sep 2, 2026 -
Medium 5.3
Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
KEV Aug 27, 2026 -
Medium 5.3
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.…
KEV Jul 29, 2026 -
Medium 5.3
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS…
KEV Jul 27, 2026 -
Medium 5.9
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
KEV Jul 21, 2026 -
Medium 5.3
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
KEV Jul 14, 2026 -
Medium 6.5
Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affect…
KEV Jun 15, 2026 -
Medium 5.8
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward…
KEV Jun 9, 2026 -
Medium 6.7
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker …
KEV May 21, 2026 -
Medium 4.0
Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
KEV May 20, 2026 -
Medium 4.3
Windows Shell Spoofing Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 28, 2026 -
Medium 6.1CVE-2025-48700 Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vu…
KEV Apr 20, 2026 -
Medium 5.4
Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access …
KEV Apr 20, 2026 -
Medium 6.5
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive inf…
KEV Apr 20, 2026 -
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 14, 2026 -
Medium 5.5
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.…
KEV Mar 20, 2026 -
Medium 4.3
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a…
KEV Mar 16, 2026 -
Medium 6.8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab a…
KEV Feb 18, 2026 -
Medium 6.2CVE-2026-21525 Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
KEV Feb 10, 2026 -
Medium 6.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…
KEV Feb 3, 2026 -
Medium 5.3
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…
KEV Jan 22, 2026 -
Medium 5.5
Desktop Window Manager Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
KEV Jan 13, 2026 -
Medium 6.6
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance managem…
KEV Dec 17, 2025 -
Medium 5.5CVE-2025-48633 Exploited
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisi…
KEV Dec 2, 2025 -
Medium 5.4
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
KEV Nov 28, 2025 -
Medium 6.7
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vu…
KEV Nov 18, 2025 -
Medium 4.6
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograp…
KEV Oct 14, 2025 -
Medium 5.4CVE-2025-27915 Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulner…
KEV Oct 7, 2025 -
Medium 6.1CVE-2025-59689 Exploited
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a…
KEV Sep 29, 2025 -
Medium 6.5
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Softwa…
KEV Sep 25, 2025 -
Medium 6.5
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not re…
KEV Sep 3, 2025 -
Medium 5.4
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp B…
KEV Sep 2, 2025