CASCACascade Atlas

Authoritative signal

Known exploited

The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9
KEV JSON is authoritativeCatalog absence remains unknown; CSV is serialization-only and never an independent vote.1,647 catalog members · showing 51–100
51
CVE-2009-3459CISA KEV

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

AdobeAcrobat and Reader

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-20
Due
2026-06-03
Priority interval
80.6–96.9
Coverage
85%
↗
52
CVE-2010-0806CISA KEV

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

MicrosoftInternet Explorer

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-20
Due
2026-06-03
Priority interval
80.1–96.4
Coverage
85%
↗
53
CVE-2009-1537CISA KEV

Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

MicrosoftDirectX

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-20
Due
2026-06-03
Priority interval
76.3–92.6
Coverage
85%
↗
54
CVE-2026-45498CISA KEVConflicting evidence

Microsoft Defender Denial of Service Vulnerability

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-20
Due
2026-06-03
Priority interval
65.9–89.6
Coverage
73%
↗
55
CVE-2026-41091CISA KEV

Microsoft Defender Link Following Vulnerability

Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-20
Due
2026-06-03
Priority interval
65.3–80.3
Coverage
85%
↗
56
CVE-2026-42897CISA KEVConflicting evidence

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

MicrosoftMicrosoft

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-15
Due
2026-05-29
Priority interval
60.0–80.0
Coverage
73%
↗
57
CVE-2026-20182CISA KEV

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

CiscoCatalyst SD-WAN

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Added
2026-05-14
Due
2026-05-17
Priority interval
83.8–98.8
Coverage
85%
↗
58
CVE-2026-42208CISA KEV

BerriAI LiteLLM SQL Injection Vulnerability

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

BerriAILiteLLM

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-08
Due
2026-05-11
Priority interval
81.9–98.1
Coverage
85%
↗
59
CVE-2026-6973CISA KEV

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

IvantiEndpoint Manager Mobile (EPMM)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-07
Due
2026-05-10
Priority interval
69.7–84.7
Coverage
85%
↗
60
CVE-2026-0300CISA KEV

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Palo Alto NetworksPAN-OS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

Added
2026-05-06
Due
2026-05-09
Priority interval
74.6–90.8
Coverage
85%
↗
61
CVE-2026-31431CISA KEV

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

LinuxKernel

Required action"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-05-01
Due
2026-05-15
Priority interval
79.1–94.1
Coverage
85%
↗
62
CVE-2026-41940CISA KEVKnown ransomware

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

WebProscPanel & WHM and WP2 (WordPress Squared)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-30
Due
2026-05-03
Priority interval
83.1–99.3
Coverage
85%
↗
63
CVE-2024-1708CISA KEVKnown ransomware

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

ConnectWiseScreenConnect

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-28
Due
2026-05-12
Priority interval
79.7–94.7
Coverage
85%
↗
64
CVE-2026-32202CISA KEV

Microsoft Windows Protection Mechanism Failure Vulnerability

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-28
Due
2026-05-12
Priority interval
66.8–81.8
Coverage
85%
↗
65
CVE-2024-7399CISA KEVConflicting evidence

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

SamsungMagicINFO 9 Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-24
Due
2026-05-08
Priority interval
81.2–98.7
Coverage
73%
↗
66
CVE-2025-29635CISA KEV

D-Link DIR-823X Command Injection Vulnerability

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

D-LinkDIR-823X

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-24
Due
2026-05-08
Priority interval
76.7–91.7
Coverage
85%
↗
67
CVE-2024-57726CISA KEVKnown ransomware

SimpleHelp Missing Authorization Vulnerability

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

SimpleHelp SimpleHelp

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-24
Due
2026-05-08
Priority interval
70.6–85.6
Coverage
85%
↗
68
CVE-2024-57728CISA KEVKnown ransomware

SimpleHelp Path Traversal Vulnerability

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

SimpleHelp SimpleHelp

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-24
Due
2026-05-08
Priority interval
63.3–78.3
Coverage
85%
↗
69
CVE-2026-39987CISA KEV

Marimo Remote Code Execution Vulnerability

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

MarimoMarimo

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-23
Due
2026-05-07
Priority interval
82.8–99.1
Coverage
85%
↗
70
CVE-2026-33825CISA KEVKnown ransomware

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-22
Due
2026-05-06
Priority interval
64.7–79.7
Coverage
85%
↗
71
CVE-2024-27199CISA KEVKnown ransomware

JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

JetBrainsTeamCity

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-20
Due
2026-05-04
Priority interval
78.2–93.2
Coverage
85%
↗
72
CVE-2023-27351CISA KEVKnown ransomware

PaperCut NG/MF Improper Authentication Vulnerability

PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

PaperCutNG/MF

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-20
Due
2026-05-04
Priority interval
76.3–93.1
Coverage
85%
↗
73
CVE-2025-32975CISA KEV

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

QuestKACE Systems Management Appliance (SMA)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-20
Due
2026-05-04
Priority interval
68.1–83.1
Coverage
85%
↗
74
CVE-2026-20133CISA KEVConflicting evidence

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

CiscoCatalyst SD-WAN Manager

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Added
2026-04-20
Due
2026-04-23
Priority interval
62.7–80.2
Coverage
73%
↗
75
CVE-2026-20128CISA KEV

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

CiscoCatalyst SD-WAN Manager

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Added
2026-04-20
Due
2026-04-23
Priority interval
63.3–78.3
Coverage
85%
↗
76
CVE-2025-2749CISA KEV

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.

KenticoKentico Xperience

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-20
Due
2026-05-04
Priority interval
61.9–76.9
Coverage
85%
↗
77
CVE-2026-20122CISA KEV

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

CiscoCatalyst SD-WAN Manger

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Added
2026-04-20
Due
2026-04-23
Priority interval
58.8–73.8
Coverage
85%
↗
78
CVE-2025-48700CISA KEV

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

SynacorZimbra Collaboration Suite (ZCS)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-20
Due
2026-04-23
Priority interval
57.9–72.9
Coverage
85%
↗
79
CVE-2026-34197CISA KEV

Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

ApacheActiveMQ

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-16
Due
2026-04-30
Priority interval
81.7–96.7
Coverage
85%
↗
80
CVE-2009-0238CISA KEV

Microsoft Office Remote Code Execution

Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

MicrosoftOffice

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-14
Due
2026-04-28
Priority interval
75.1–91.4
Coverage
85%
↗
81
CVE-2026-32201CISA KEV

Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

MicrosoftSharePoint Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-14
Due
2026-04-28
Priority interval
65.5–80.5
Coverage
85%
↗
82
CVE-2026-21643CISA KEV

Fortinet FortiClient EMS SQL Injection Vulnerability

Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

FortinetFortiClient EMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-16
Priority interval
83.9–98.9
Coverage
85%
↗
83
CVE-2023-21529CISA KEVKnown ransomware

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

MicrosoftExchange Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
77.8–92.8
Coverage
85%
↗
84
CVE-2020-9715CISA KEVConflicting evidence

Adobe Acrobat Use-After-Free Vulnerability

Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

AdobeAcrobat

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
73.4–92.2
Coverage
73%
↗
85
CVE-2012-1854CISA KEVConflicting evidence

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.

MicrosoftVisual Basic for Applications (VBA)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
66.4–83.7
Coverage
73%
↗
86
CVE-2026-34621CISA KEV

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

AdobeAcrobat and Reader

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
66.8–81.8
Coverage
85%
↗
87
CVE-2023-36424CISA KEV

Microsoft Windows Out-of-Bounds Read Vulnerability

Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
66.5–81.5
Coverage
85%
↗
88
CVE-2025-60710CISA KEV

Microsoft Windows Link Following Vulnerability

Microsoft Windows contains a link following vulnerability that allows for privilege escalation

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-13
Due
2026-04-27
Priority interval
63.8–78.8
Coverage
85%
↗
89
CVE-2026-1340CISA KEV

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

IvantiEndpoint Manager Mobile (EPMM)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-08
Due
2026-04-11
Priority interval
82.8–97.8
Coverage
85%
↗
90
CVE-2026-35616CISA KEV

Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

FortinetFortiClient EMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-06
Due
2026-04-09
Priority interval
83.3–98.3
Coverage
85%
↗
91
CVE-2026-3502CISA KEV

TrueConf Client Download of Code Without Integrity Check Vulnerability

TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

TrueConfClient

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-02
Due
2026-04-16
Priority interval
64.3–79.3
Coverage
85%
↗
92
CVE-2026-5281CISA KEV

Google Dawn Use-After-Free Vulnerability

Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

GoogleDawn

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-04-01
Due
2026-04-15
Priority interval
66.5–81.5
Coverage
85%
↗
93
CVE-2026-3055CISA KEV

Citrix NetScaler Out-of-Bounds Read Vulnerability

Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.

CitrixNetScaler

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-30
Due
2026-04-02
Priority interval
81.6–97.8
Coverage
85%
↗
94
CVE-2025-53521CISA KEV

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.

F5BIG-IP

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-27
Due
2026-03-30
Priority interval
66.2–82.5
Coverage
85%
↗
95
CVE-2026-33634CISA KEVConflicting evidence

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.

AquasecurityTrivy

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-26
Due
2026-04-09
Priority interval
77.5–94.0
Coverage
73%
↗
96
CVE-2026-33017CISA KEV

Langflow Code Injection Vulnerability

Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

LangflowLangflow

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-25
Due
2026-04-08
Priority interval
83.1–99.3
Coverage
85%
↗
97
CVE-2025-32432CISA KEV

Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Craft CMSCraft CMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-20
Due
2026-04-03
Priority interval
85.0–100.0
Coverage
85%
↗
98
CVE-2025-54068CISA KEV

Laravel Livewire Code Injection Vulnerability

Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.

LaravelLivewire

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-20
Due
2026-04-03
Priority interval
82.5–99.0
Coverage
85%
↗
99
CVE-2025-31277CISA KEV

Apple Multiple Products Buffer Overflow Vulnerability

Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.

AppleMultiple Products

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-20
Due
2026-04-03
Priority interval
64.4–79.4
Coverage
85%
↗
100
CVE-2025-43510CISA KEV

Apple Multiple Products Improper Locking Vulnerability

Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.

AppleMultiple Products

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added
2026-03-20
Due
2026-04-03
Priority interval
60.7–75.7
Coverage
85%
↗