Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Meta PlatformsWhatsApp
Required actionApply updates per vendor instructions.
Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
SynacorZimbra Collaboration Suite (ZCS)
Required actionApply updates per vendor instructions.
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
CrestronMultiple Products
Required actionApply updates per vendor instructions.
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
AlcatelOmniPCX Enterprise
Required actionApply updates per vendor instructions.
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
D-LinkDNS-320 Storage Device
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
InduSoftWeb Studio
Required actionApply updates per vendor instructions.
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
Schneider ElectricU.motion Builder
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
UbiquitiAirOS
Required actionApply updates per vendor instructions.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
VMwareMultiple Products
Required actionApply updates per vendor instructions.
The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
TrihedralVTScada (formerly VTS)
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
VMwareWorkspace ONE Access and Identity Manager
Required actionApply updates per vendor instructions.
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
DrupalCore
Required actionApply updates per vendor instructions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
KaseyaVirtual System/Server Administrator (VSA)
Required actionApply updates per vendor instructions.
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
TelerikUser Interface (UI) for ASP.NET AJAX
Required actionApply updates per vendor instructions.
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftActive Directory
Required actionApply updates per vendor instructions.
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
QNAPQNAP Network-Attached Storage (NAS)
Required actionApply updates per vendor instructions.
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
CheckboxCheckbox Survey
Required actionVersions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftActive Directory
Required actionApply updates per vendor instructions.
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
WatchGuardFirebox and XTM
Required actionApply updates per vendor instructions.
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
LinuxKernel
Required actionApply updates per vendor instructions.
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
GooglePixel
Required actionApply updates per vendor instructions.
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
MicrosoftHTTP Protocol Stack
Required actionApply updates per vendor instructions.
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
MicrosoftSMBv1 server
Required actionApply updates per vendor instructions.
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
SudoSudo
Required actionApply updates per vendor instructions.
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
D-LinkMultiple Routers
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
VMwareSpring Framework
Required actionApply updates per vendor instructions.
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
ApplemacOS
Required actionApply updates per vendor instructions.
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
ApplemacOS
Required actionApply updates per vendor instructions.
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
DasanGigabit Passive Optical Network (GPON) Routers
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
SophosFirewall
Required actionApply updates per vendor instructions.
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
DasanGigabit Passive Optical Network (GPON) Routers
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
QNAPNetwork Attached Storage (NAS)
Required actionApply updates per vendor instructions.
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Delldbutil Driver
Required actionApply updates per vendor instructions.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Trend MicroApex Central
Required actionApply updates per vendor instructions.
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
RedisDebian-specific Redis Servers
Required actionApply updates per vendor instructions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
OracleJava SE
Required actionApply updates per vendor instructions.
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
OracleJava SE
Required actionApply updates per vendor instructions.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
AdobeReader and Acrobat
Required actionApply updates per vendor instructions.