Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.
SamsungMobile Devices
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
AdobeAcrobat and Reader
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
GoogleChromium WebP
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
CiscoAdaptive Security Appliance and Firepower Threat Defense
Required actionApply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
AndroidFramework
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftStreaming Service Proxy
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft Word contains an unspecified vulnerability that allows for information disclosure.
MicrosoftWord
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
AppleiOS, iPadOS, and macOS
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
AppleiOS, iPadOS, and watchOS
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
ApacheRocketMQ
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Ignite RealtimeOpenfire
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
RARLABWinRAR
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
IvantiSentry
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
VeeamBackup & Replication
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
AdobeColdFusion
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
CitrixContent Collaboration
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
Microsoft.NET Core and Visual Studio
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
ZyxelP660HN-T1A Routers
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).
IvantiEndpoint Manager Mobile (EPMM)
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.
SynacorZimbra Collaboration Suite (ZCS)
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
AppleMultiple Products
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
IvantiEndpoint Manager Mobile (EPMM)
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
AdobeColdFusion
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
AdobeColdFusion
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.
CitrixNetScaler ADC and NetScaler Gateway
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
MicrosoftWindows
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.
SolarViewCompact
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
AppleMultiple Products
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
NetwrixAuditor
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.
MicrosoftOutlook
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
MicrosoftWindows
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
ArmMali Graphics Processing Unit (GPU)
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
D-LinkDIR-859 Router
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
D-LinkDWL-2600AP Access Point
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
SamsungMobile Devices
Required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
ZyxelMultiple Network-Attached Storage (NAS) Devices
Required actionApply updates per vendor instructions.
Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
AppleMultiple Products
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
AppleMultiple Products
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
AppleMultiple Products
Required actionApply updates per vendor instructions.
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
VMwareTools
Required actionApply updates per vendor instructions.
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
VMwareAria Operations for Networks
Required actionApply updates per vendor instructions.
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
RoundcubeRoundcube Webmail
Required actionApply updates per vendor instructions.
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
RoundcubeRoundcube Webmail
Required actionApply updates per vendor instructions.