Vendor
ivanti
413 known vulnerabilities.
Products
Avalanche 92
Endpoint Manager 73
Connect Secure 65
Policy Secure 52
EPM 33
Endpoint Manager Mobile 25
Secure Access Client 15
ZTA Gateway 15
Neurons for Secure Access 13
EPMM 11
Workspace Control 10
Sentry 10
Xtraction 8
CSA (Cloud Services Appliance) 6
Cloud Services Application 6
Neurons for ITSM 5
ICS 5
IPS 5
ITSM 5
Wavelink 4
Neurons for ZTA gateways 3
DSM 3
Ivanti Neurons for ITSM 3
Neurons for ITSM (Cloud) 3
MobileIron Core 2
Ivanti Endpoint Manager 2
Neurons for ITSM (On-Premise) 2
Secure Access Client Windows 2
Desktop and Server Management 2
Secure Access Linux 2
Security Controls 2
Neurons for Secure 2
Automation 2
Docs@Work 1
LANDesk Management Suite 1
Connect Secure 22.7R2.9 1
Patch SDK 1
Patch for Configuration Manager 1
Neurons for Patch Management 1
Neurons Agent Platform 1
92 results · Clear filters · Feed
-
Medium 4.9
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker…
-
Medium 5.5
An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authentic…
-
Medium 4.9
Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attac…
-
Medium 4.9
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 6.7
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 5.5
A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated …
-
Medium 5.5
An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 1…
-
Medium 6.7
Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with…
-
Medium 6.8
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows …
-
Medium 6.3
Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to…
-
Medium 4.3CVE-2026-118527 Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…
KEV Oct 30, 2026 -
Medium 5.5
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a r…
-
Medium 5.0
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to crea…
-
Medium 4.0
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users…
-
Medium 6.5
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authe…
-
Medium 4.4
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local …
-
Medium 5.4
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information …
-
Medium 5.7
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker …
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 4.7
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authen…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 5.4
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
Medium 6.1
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivan…
-
Medium 6.8
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…
-
Medium 4.9
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Iva…
-
Medium 5.4
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…
-
Medium 5.4
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
Medium 5.5
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure be…
-
Medium 4.9
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before…
-
Medium 6.5
Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows…