Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
MicrosoftEdge
Required actionApply updates per vendor instructions.
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
MozillaFirefox and Thunderbird
Required actionApply updates per vendor instructions.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
MicrosoftEdge
Required actionApply updates per vendor instructions.
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
MicrosoftEdge and Internet Explorer
Required actionApply updates per vendor instructions.
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
MicrosoftWord
Required actionApply updates per vendor instructions.
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
MicrosoftWindows
Required actionApply updates per vendor instructions.
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
SonicWallSecure Remote Access (SRA)
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.
MicrosoftClient-Server Run-time Subsystem (CSRSS)
Required actionApply updates per vendor instructions.
Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
MicrosoftOffice
Required actionApply updates per vendor instructions.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
AtlassianConfluence Server
Required actionApply updates per vendor instructions.
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.
MicrosoftAncillary Function Driver (afd.sys)
Required actionApply updates per vendor instructions.
The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
MicrosoftOffice
Required actionApply updates per vendor instructions.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
MicrosoftDirectX Graphics Kernel (DXGKRNL)
Required actionApply updates per vendor instructions.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
MicrosoftDirectX Graphics Kernel (DXGKRNL)
Required actionApply updates per vendor instructions.
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
SonicWallSMA100
Required actionApply updates per vendor instructions.
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors
OracleFusion Middleware
Required actionApply updates per vendor instructions.
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
D-LinkMultiple Routers
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
ZyxelMultiple Network-Attached Storage (NAS) Devices
Required actionApply updates per vendor instructions.
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
WebminWebmin
Required actionApply updates per vendor instructions.
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
RejettoHTTP File Server (HFS)
Required actionApply updates per vendor instructions.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
CiscoIOS and IOS XE
Required actionApply updates per vendor instructions.
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
OpenBSDOpenSMTPD
Required actionApply updates per vendor instructions.
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
NETGEARWireless Access Point (WAP) Devices
Required actionApply updates per vendor instructions.
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
SitecoreXP
Required actionApply updates per vendor instructions.
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
SophosSG UTM
Required actionApply updates per vendor instructions.
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
PHPPHP
Required actionApply updates per vendor instructions.
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
ApacheStruts
Required actionApply updates per vendor instructions.
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
ElasticElasticsearch
Required actionApply updates per vendor instructions.
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
AdobeColdFusion
Required actionApply updates per vendor instructions.
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
PHPFastCGI Process Manager (FPM)
Required actionApply updates per vendor instructions.
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
QuestKACE System Management Appliance
Required actionApply updates per vendor instructions.
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
KenticoXperience
Required actionApply updates per vendor instructions.
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
VMware TanzuSpring Data Commons
Required actionApply updates per vendor instructions.
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
phpMyAdminphpMyAdmin
Required actionApply updates per vendor instructions.
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
CitrixSD-WAN and NetScaler
Required actionApply updates per vendor instructions.
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
LGN1A1 NAS
Required actionApply updates per vendor instructions.
The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.
NETGEARWNR2000v5 Router
Required actionApply updates per vendor instructions.
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
MitelMiCollab, MiVoice Business Express
Required actionApply updates per vendor instructions.
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
D-Link and TRENDnetMultiple Devices
Required actionThe impacted product is end-of-life and should be disconnected if still in use.