#CISA KEV
All CosmicBytez Labs articles tagged #CISA KEV, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Pre-auth path traversal flaw (CVSS 9.3) exposes files in 8 Atlassian Data Center products; CISA confirms active exploitation.
- News
Honeypots Log 105 Attacks on Ivanti Connect Secure Ahead of CISA Deadline
Previdian logged 105 exploit attempts from 50 IPs against the Ivanti ICS zero-day chain as CISA's Oct 16 federal patch deadline nears.
- News
Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles
UTA0576 chained CVE-2026-104935 with two more flaws for root-level RCE on patched Ivanti Connect Secure VPNs after a July fix missed the full bypass.
- News
Palo Alto Networks Warns of PAN-OS RCE Flaw Exploited in Attacks
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS management-interface RCE (CVSS 8.6) already exploited in limited attacks; CISA added it to KEV.
- Security
CVE-2015-5477: Decade-Old ISC BIND TKEY Flaw Added to CISA's KEV Catalog
A 2015 reachable-assertion DoS bug in ISC BIND's TKEY handling hit CISA's KEV catalog Oct. 8, 2026 after Flax Typhoon exploitation; patch by Oct. 11.
- Security
CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
CISA added this 2021 ONLYOFFICE Docs path traversal (CVSS 9.8) to its KEV catalog on Oct 8, 2026, confirming active RCE exploitation.
- News
Citrix Discloses Third Actively Exploited NetScaler Zero-Day in Less Than a Week
Citrix's CVE-2026-88779 SAML flaw is the third actively exploited NetScaler zero-day in a week, but a faster vendor response limited the fallout.
- News
Citrix's Third NetScaler Zero-Day in Five Weeks Hits Appliances Patched Days Earlier
CVE-2026-88779 struck NetScaler appliances patched days earlier for two other zero-days; CISA's KEV listing set an October 7 deadline.
- News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added FortiMail flaw CVE-2026-104286 (CVSS 9.8) to its KEV catalog after active exploitation; no patch yet, only workarounds.
- News
Critical FortiMail Zero-Day CVE-2026-104286 Actively Exploited, No Patch Yet
CISA added CVSS 9.8 FortiMail flaw CVE-2026-104286 to its KEV catalog after active exploitation; Fortinet has no fix, only workarounds.
- Security
CVE-2026-102489: Zammad Session Fixation Flaw Added to CISA KEV Catalog
CISA added CVE-2026-102489, a Zammad session fixation bug chaining to RCE as the zammad user, to its KEV catalog after active exploitation.
- Security
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
A local privilege escalation flaw lets the zammad user gain root on any Zammad instance; chainable with CVE-2026-102489, actively exploited, now in CISA KEV.
- News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco warns attackers are actively exploiting CVE-2026-76504, a critical 9.8 CVSS auth bypass granting admin API access to SD-WAN Manager.
- News
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Apple confirms CVE-2026-86950 was used in a sophisticated spyware-style attack on specific targets; CISA set an Oct. 2 deadline for agencies.
- News
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
Two critical NetScaler zero-days (CVSS 9.5) hit default Citrix configs; CISA lists both as exploited, with no workarounds available.
- News
Citrix Patches Actively Exploited NetScaler Zero-Days After a Weekend of Unofficial Warnings
Citrix stayed publicly silent for days while CERTs, insurers, and researchers warned of active NetScaler exploitation ahead of its own advisory.
- News
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2's CVE-2026-5430 (CVSS 9.8) and Adobe Commerce/Magento's CVE-2026-71362 (CVSS 9.1) to its KEV catalog after confirmed in-the-wild exploitation.
- Security
CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
An unauthenticated SSH workflow-bypass in MikroTik RouterOS chains with CVE-2026-86060 for full router takeover; CISA added it to KEV on Sept 25.
- Security
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
CISA added CVE-2026-5430 to its KEV catalog after active exploitation of a critical, unauthenticated WSO2 API management flaw.
- Security
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
CVE-2026-71362 (CVSS 9.1) lets unauthenticated attackers hijack Adobe Commerce and Magento customer sessions; CISA added it to KEV after active exploitation.
- News
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista's VeloCloud Orchestrator has a critical zero-day (CVE-2026-93952, CVSS 10.0) under active attack; patch now or restrict web-interface access.
- News
Check Point Warns of Hackers Exploiting Security Gateway VPN RCE Flaw
Check Point confirms active exploitation of CVE-2026-85102, a CVSS 9.8 pre-auth RCE in Security Gateway VPN certificate handling; CISA set a Sept 25 deadline.
- News
F5 Patches BIG-IP APM Zero-Day Flaw Exploited in RCE Attacks
F5 patched CVE-2026-94127, a CVSS 9.8 BIG-IP APM zero-day already exploited for unauthenticated RCE; CISA added it to its KEV catalog.
- News
InfraTrust Report Warns Network Management Systems Under Attack
Eclypsium's InfraTrust Pulse finds 158 advisories across 17 vendors as attackers target network management consoles before or at disclosure.
- Security
CVE-2026-7273: Zyxel GS1900 Switches Stack Buffer Overflow Now Actively Exploited
CISA added this unauthenticated LAN RCE flaw in Zyxel GS1900 switches to its KEV catalog after confirming active exploitation.
- Security
CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
Heap-based buffer overflow in F5 BIG-IP APM (OAuth + access policy) allows unauthenticated RCE; added to CISA KEV as actively exploited.
- News
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco patches CVE-2026-76460, a CVSS 10.0 ISE auth bypass exploited in the wild; CISA gives federal agencies until Sept. 19 to patch.
- Security
CVE-2026-58704: Google Pixel Improper Authorization Vulnerability
A CVSS 8.0 improper authorization flaw in Google Pixel's cellular modem is under active, targeted exploitation and added to CISA's KEV catalog.
- News
Cisco Secure Email Gateway Zero-Day Exploited to Execute Root Commands
CVE-2026-76461 (CVSS 9.8) lets attackers send crafted emails with malicious SQL to gain root RCE on Cisco Secure Email Gateway; CISA gives feds 3 days.
- News
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
CVE-2026-85706 (CVSS 10.0) lets unauthenticated attackers read arbitrary files via GitLab's commits API. Already actively exploited.
- Security
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Secure Email Gateway has a critical, unauthenticated SQL injection (CVSS 9.8) enabling root code execution. CISA KEV-listed as actively exploited.
- News
GitLab's CVSS 10 File-Read Flaw Draws Probes Within Hours of Disclosure
CVE-2026-85706, a CVSS 10 GitLab path traversal, hit CISA's KEV catalog after watchTowr spotted active probing the same day it was patched.
- Security
CVE-2026-42018: JFrog Artifactory Auth Bypass Chained for Admin Takeover
JFrog Artifactory can return an anonymous admin token to unauthenticated callers; attackers are chaining this in the wild. Added to CISA KEV.
- Security
CVE-2026-84869: ConnectWise ScreenConnect Unauthorized File Transfer & Execution
A critical ScreenConnect client flaw lets attackers transfer and execute files through active remote sessions without host confirmation.
- Security
CVE-2026-85706: GitLab Path Traversal Flaw Hit CVSS 10.0, Added to CISA KEV
Unauthenticated attackers can read arbitrary files via GitLab's commits API. Exploited a day after disclosure; now in CISA's KEV catalog.
- Security
CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation
Unauthenticated attackers can escalate to full admin control on MikroTik RouterOS via a crafted SSH username; CISA lists it as actively exploited.
- News
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
September's Patch Tuesday breaks records with 974 CVEs fixed, including two actively exploited Windows zero-days now on CISA's KEV catalog.
- Security
CVE-2026-81963: Windows Link Following Flaw Lets Local Attackers Reach SYSTEM
CISA added an actively exploited Windows Update Stack privilege escalation flaw to its KEV catalog, giving federal agencies until Sep 22 to patch.
- News
Attackers Exploit Two Chained Zero-Days in SonicWall SMA 1000 Appliances
SonicWall discloses two SMA 1000 zero-days, one CVSS 10.0, chained for unauthenticated RCE and now on CISA's KEV list with active exploitation.
- News
Attackers Chain Two New Zero-Days in SonicWall's Besieged SMA 1000
CVE-2026-83548 and CVE-2026-83549 chain into unauthenticated RCE on SonicWall SMA 1000 — the fifth SMA 1000 KEV entry since December.
- News
Recently Patched PaperCut Zero-Days Used in Data Theft Attacks
Attackers exploiting PaperCut NG/MF's patched auth-bypass and RCE chain have pivoted to dumping database tables instead of deploying payloads.
- Security
CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability
Critical unsafe reflection flaw in PaperCut NG/MF lets attackers run arbitrary Java code; now on CISA's KEV list and tied to active data theft.
- News
AI Is Accelerating Vulnerability Discovery — Can Defenders Keep Up?
Disclosed vulnerabilities jumped 92% in a year as AI accelerates discovery, but enrichment and remediation infrastructure hasn't kept pace.
- News
Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks
Shadowserver finds 8,300+ exposed Gitea instances unpatched against CVE-2026-60004, a critical RCE flaw already deploying cryptominers.
- Security
CVE-2026-66384: JFrog Artifactory Path Traversal Added to CISA KEV
CISA added CVE-2026-66384, a JFrog Artifactory Docker-cache path traversal flaw, to its KEV catalog after confirmed active exploitation.
- Security
CVE-2023-49105: CISA Adds ownCloud Auth Bypass to KEV After Nuclear Data Theft
CISA added ownCloud's critical pre-signed URL auth-bypass flaw (CVSS 9.8) to its KEV catalog after it was used to steal Philippine nuclear data.
- News
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
CVE-2026-60004 lets any registered Gitea user hijack the server via a Git hook injection; CISA adds it to KEV after a reported miner deployment.
- Security
CISA Adds 2019 Microsoft SQL Server RCE Flaw to KEV Catalog
CISA added CVE-2019-1068, a seven-year-old Microsoft SQL Server RCE flaw, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
- Security
CISA Adds Ajax.NET Professional Deserialization RCE to KEV Catalog
CISA added CVE-2021-23758, a critical unauthenticated deserialization RCE in the end-of-life AjaxPro.2 library, to its Known Exploited Vulnerabilities catalog.
- Newsletter
Weekly Digest — Issue #32
Oracle WebLogic and Keycloak both land on active-exploitation radar, a critical isolated-vm sandbox escape threatens AI agent stacks, and the US sanctions...
- Newsletter
Weekly Digest — Issue #31
3.5M enterprise records stolen via Azure infostealer campaign, China-nexus APT mass-exploits vCenter in 5 days, and CISA adds Microsoft IKE RCE to KEV.
- Security
Microsoft IKE Service Extensions Double Free RCE (CVE-2026-33824)
CISA-flagged double free vulnerability in Microsoft IKE Service Extensions enables unauthenticated remote code execution. Patch immediately.
- Security
CVE-2026-68820: Windows WinSock Driver Use-After-Free Privilege Escalation
Actively exploited use-after-free in Windows afd.sys (WinSock driver) enables local privilege escalation to SYSTEM. CVSS 7.0. Patch immediately.
- Security
CVE-2026-20349: Cisco ASA and FTD Heap Inspection Vulnerability
Cisco Secure Firewall ASA and FTD contain a heap inspection vulnerability allowing unauthenticated remote attackers to crash devices and trigger a denial...
- Security
CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
Critical unauthenticated command injection in Progress LoadMaster lets attackers run arbitrary OS commands. Listed on the CISA KEV catalog — patch immediately.
- Security
Gladinet CentreStack / Triofox Hardcoded AES Key Enables Unauthenticated LFI and RCE Chain
A hardcoded AES cryptographic key in Gladinet CentreStack and Triofox allows unauthenticated attackers to exploit arbitrary local file inclusion, with...
- Security
CVE-2026-63077: JetBrains TeamCity Deserialization RCE Added to CISA KEV
JetBrains TeamCity contains a critical deserialization of untrusted data vulnerability allowing unauthenticated remote code execution via the agent...
- News
Prolific Ransomware Group Behind SonicWall Zero-Day Attacks
INC ransomware — responsible for nearly 900 victims across 71 countries — has emerged as the dominant actor exploiting a chained pair of SonicWall SMA...
- Security
CVE-2026-9198: IBM Langflow Code Injection Vulnerability
A critical unauthenticated code injection flaw in Langflow 1.0.0–1.10.0 allows attackers to chain two API endpoints to obtain a SUPERUSER token and...
- Security
CVE-2026-18577: N-able N-central Authentication Bypass and Account Takeover
N-able N-central contains an authentication bypass via alternate path vulnerability enabling full account takeover, added to CISA KEV as an incomplete...
- News
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
CISA has added a newly disclosed Cisco Secure Firewall Management Center zero-day to its Known Exploited Vulnerabilities catalog following confirmed...
- Security
CVE-2026-20316: Cisco FMC Hardcoded Password Gives Unauthenticated Remote Access
A hardcoded static credential in Cisco Secure Firewall Management Center allows unauthenticated remote attackers to log in and access sensitive data. CISA...
- Security
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a critical deserialization of untrusted data vulnerability allowing unauthenticated attackers to execute arbitrary code over...
- Security
CVE-2026-16232: Check Point SmartConsole Improper Authentication
A critical improper authentication flaw in Check Point SmartConsole allows unauthenticated remote attackers to steal login tokens and gain full admin...
- Security
CVE-2023-4346: KNX Protocol Connection Authorization Option 1 Account Lockout Vulnerability
A vulnerability in KNX Association KNX Protocol Connection Authorization Option 1 allows an attacker to purge all devices without additional security...
- News
SonicWall Warns of SMA1000 Flaws Exploited in Zero-Day Attacks, Patch Now
SonicWall has issued an urgent advisory warning that two vulnerabilities in its SMA 1000 series secure remote access appliances are being actively...
- Security
CVE-2026-56155: Microsoft AD FS Access Control Flaw Enables Golden SAML Attacks
Microsoft's July 2026 Patch Tuesday fixes CVE-2026-56155, an actively exploited privilege escalation flaw in Active Directory Federation Services....
- News
CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions
CISA has added two Joomla extension vulnerabilities to its KEV catalog after attackers began exploiting arbitrary file upload flaws in iCagenda and...
- Security
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco IOS 12.4 contains multiple CSRF vulnerabilities that allow remote attackers to execute arbitrary commands. The flaw has been added to the CISA Known...
- Security
CVE-2026-48939: iCagenda Unrestricted File Upload Allows PHP Code Execution
A critical unrestricted file upload vulnerability in the iCagenda Joomla event calendar plugin allows unauthenticated attackers to upload arbitrary PHP...
- News
Zimbra Urges Customers to Patch Critical Web Client XSS Flaw Exploited in the Wild
CVE-2025-27915, a stored XSS vulnerability in Zimbra's Classic Web Client, was exploited as a zero-day before public disclosure. Attackers used malicious...
- Security
CVE-2026-56291: Balbooa Forms Unrestricted File Upload Enables Full RCE
A critical unauthenticated file upload vulnerability in Balbooa Forms for Joomla allows attackers to upload executable files and achieve full remote code...
- Security
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted File Upload RCE
A critical unrestricted file upload vulnerability in JoomShaper's SP Page Builder allows unauthenticated attackers to upload arbitrary PHP files and...
- Security
CVE-2026-56290: Joomlack Page Builder Unauthenticated File Upload RCE — CISA KEV
A CVSS 10.0 unauthenticated arbitrary file upload vulnerability in the Joomlack Page Builder CK Joomla extension allows any remote attacker to upload a...
- News
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA has added a high-severity Microsoft SharePoint Server remote code execution vulnerability to its Known Exploited Vulnerabilities catalog following...
- Security
CVE-2026-12569: PTC Windchill and FlexPLM Remote Code Execution Vulnerability
A critical unauthenticated RCE vulnerability in PTC Windchill and FlexPLM (CVSS 9.3) has been added to CISA's Known Exploited Vulnerabilities catalog,...
- Security
CVE-2025-67038: Lantronix EDS5000 OS Command Injection Vulnerability
A critical OS command injection flaw in the Lantronix EDS5000 serial device server allows unauthenticated attackers to inject arbitrary commands via the...
- Security
CVE-2026-48907: Joomla Content Editor Unauthenticated PHP Upload Flaw
A maximum-severity improper access control flaw in Widget Factory's Joomla Content Editor allows unauthenticated attackers to upload and execute arbitrary...
- Security
CVE-2026-20262: Cisco Catalyst SD-WAN Manager Path Traversal Vulnerability
Cisco Catalyst SD-WAN Manager contains a directory path traversal vulnerability allowing an authenticated remote attacker to create or overwrite any file...
- Security
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
A critical out-of-bounds read and write vulnerability in the Chromium V8 engine allows remote attackers to execute arbitrary code inside a sandbox via a...
- Security
CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption (DoS)
SolarWinds Serv-U contains an unauthenticated DoS vulnerability allowing specially crafted POST requests with Content-Encoding: deflate to crash the service…
- Security
CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability
A Linux kernel vulnerability in the cgroups v1 release_agent feature allows local attackers to escalate privileges and escape containers. Added to CISA KEV…
- Security
CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability allowing unauthenticated attackers network access via T3 and IIOP protocols, potentially exposing…
- Security
CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability
CISA adds CVE-2026-8398 to KEV — a high-severity embedded malicious-code flaw in Daemon Tools Lite impacting confidentiality, integrity, and availability.
- Security
CVE-2026-48027: Nx Console Embedded Malicious Code — CISA KEV
CISA adds CVE-2026-48027 to KEV after a malicious Nx Console VS Code extension was found harvesting credentials from disk and memory via obfuscation.
- Security
CVE-2025-34291: Langflow Origin Validation Error
CISA adds CVE-2025-34291 to the Known Exploited Vulnerabilities catalog — an overly permissive CORS configuration combined with a SameSite=None refresh...
- Security
CVE-2026-20182: Cisco Catalyst SD-WAN Controller
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass...
- Security
CVE-2026-31431: Linux Kernel Privilege Escalation via Incorrect Resource Transfer
A Linux Kernel vulnerability involving incorrect resource transfer between spheres has been added to CISA's Known Exploited Vulnerabilities catalog,...
- Security
CVE-2026-41940: WebPros cPanel & WHM and WP2 Missing
WebPros cPanel, WHM, and WP2 (WordPress Squared) contain a critical authentication bypass in the login flow, allowing unauthenticated remote attackers to...
- News
CISA Adds Actively Exploited ConnectWise and Windows Flaws
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2024-1708 affecting ConnectWise ScreenConnect...
- Security
CVE-2024-1708: ConnectWise ScreenConnect Path Traversal
ConnectWise ScreenConnect contains a path traversal vulnerability (CVE-2024-1708) that allows attackers to execute remote code or directly access...
- Security
CVE-2025-29635: D-Link DIR-823X Command Injection
A command injection flaw in end-of-life D-Link DIR-823X routers allows authenticated remote attackers to execute arbitrary OS commands. CISA has added...
- Security
CVE-2026-39987: Marimo Pre-Auth Remote Code Execution
A critical pre-authorization remote code execution vulnerability in Marimo, the open-source reactive Python notebook, allows unauthenticated attackers to...
- Security
CVE-2025-2749: Kentico Xperience Path Traversal
Kentico Xperience contains a path traversal vulnerability allowing an authenticated user's Staging Sync Server to upload arbitrary data to relative path...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- Security
CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use
Cisco Catalyst SD-WAN Manager contains a privileged API misuse vulnerability that allows an attacker to upload a malicious file to the local file system...
- News
Recent Apache ActiveMQ Vulnerability Exploited in the Wild
CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ's Jolokia management API, is being actively exploited in the wild. CISA has added...
- News
CISA Flags Apache ActiveMQ Flaw as Actively Exploited in Attacks
CISA has added a high-severity Apache ActiveMQ vulnerability to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the...
- News
1 Billion CISA KEV Records Reveal Human-Scale Security Has
A Qualys analysis of over one billion CISA Known Exploited Vulnerabilities remediation records shows that most critical flaws are being actively exploited...
- Security
CVE-2026-1340: Ivanti EPMM Code Injection Vulnerability
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the Android File Transfer module allowing unauthenticated remote code...
- Security
CVE-2026-3502: TrueConf Client Update Integrity Bypass
TrueConf Client fails to verify the integrity of downloaded update payloads, allowing an attacker who can influence the update delivery path to substitute...
- Newsletter
Mar 31 Digest: Axios npm RAT, Claude Code Source Leaked
The Axios npm library was weaponized to deliver a cross-platform RAT; Anthropic accidentally leaked Claude Code's CLI source in an npm package; Google...
- Security
CVE-2025-53521: F5 BIG-IP APM Remote Code Execution — CISA
A critical unauthenticated RCE vulnerability in F5 BIG-IP APM is being actively exploited in the wild. Malicious traffic targeting access policy virtual...
- Newsletter
Mar 27 Digest: EU Commission AWS Breach, DarkSword iOS
The European Commission confirms a 350 GB AWS breach; the DarkSword iOS exploit chain goes public on GitHub threatening hundreds of millions of iPhones;...
- News
CISA Adds Apple DarkSword iOS Exploits, Craft CMS, and Laravel Livewire Flaws to KEV Catalog
CISA orders federal agencies to patch five actively exploited vulnerabilities by April 3, including three Apple flaws linked to the DarkSword iOS exploit...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...
- Security
CVE-2025-54068: Laravel Livewire Code Injection
A critical code injection vulnerability in Laravel Livewire v3 allows unauthenticated remote attackers to execute arbitrary commands. Over 130,000...
- Security
CVE-2025-32432: Craft CMS Code Injection Vulnerability
A critical code injection vulnerability in Craft CMS allows unauthenticated remote attackers to execute arbitrary code on affected servers. Added to...
- News
CISA Adds Wing FTP Server Flaw to KEV as RCE Chain Exploits
CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities catalog on March 16, warning that the medium-severity path disclosure flaw is being...
- Security
CVE-2025-47813: Wing FTP Server Path Disclosure Enables RCE
CISA has added CVE-2025-47813, a medium-severity information disclosure flaw in Wing FTP Server, to its KEV catalog after confirming active exploitation...
- News
CISA Flags Actively Exploited n8n RCE Bug as 24,700
CISA added CVE-2025-68613 — a CVSS 9.9 remote code execution flaw in n8n's workflow expression evaluator — to its Known Exploited Vulnerabilities catalog...
- News
CISA Orders Federal Agencies to Patch n8n RCE Flaw
CISA mandated all federal civilian agencies patch CVE-2025-68613, a CVSS 9.9 remote code execution flaw in the n8n workflow automation platform, after...
- Security
CVE-2025-68613: n8n Remote Code Execution via Improper
CISA adds CVE-2025-68613 to the Known Exploited Vulnerabilities catalog — a CVSS 9.9 flaw in n8n's workflow expression evaluation system that enables...
- Security
Microsoft MSHTML Framework Security Feature Bypass
An actively exploited protection mechanism failure in the Windows MSHTML (Trident) engine allows attackers to bypass browser security zones and shell...
- Security
Microsoft Office Word OLE Security Feature Bypass
An actively exploited zero-day in Microsoft Word allows attackers to bypass OLE protections and execute malicious Office documents silently, without...
- Security
Soliton FileZen OS Command Injection Under Active
A high-severity OS command injection vulnerability in Soliton Systems FileZen secure file transfer appliances is being actively exploited. Authenticated...
- Security
BeyondTrust Remote Support and PRA Critical RCE Under
A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access is under active exploitation,...
- Security
BeyondTrust Remote Support Pre-Authentication RCE Under
A critical pre-authentication OS command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access with CVSS 9.9 is being...
- Security
Cisco Unified Communications Zero-Day Exploited for Root RCE
An actively exploited zero-day in Cisco Unified Communications allows unauthenticated remote code execution with root privileges via crafted HTTP...
- Security
SolarWinds Web Help Desk RCE Vulnerability Added to CISA KEV
Critical deserialization vulnerability in SolarWinds Web Help Desk enables unauthenticated remote code execution. CISA confirms active exploitation.