Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.
MicrosoftWindows
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
MicrosoftWindows
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.
MicrosoftTask Scheduler
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
MicrosoftWindows
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
MicrosoftWindows
Required actionApply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
AdobeColdFusion
Required actionApply updates per vendor instructions.
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
NETGEARMultiple Routers
Required actionApply updates per vendor instructions.
Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
AtlassianJira Server and Data Center
Required actionApply updates per vendor instructions.
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
NETGEARWireless Router DGN2200
Required actionApply updates per vendor instructions.
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
AdobeBlazeDS
Required actionApply updates per vendor instructions.
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
AdobeColdFusion
Required actionApply updates per vendor instructions.
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
AdobeColdFusion
Required actionApply updates per vendor instructions.
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
VMwarevCenter Server and Cloud Foundation
Required actionApply updates per vendor instructions.
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
MozillaFirefox
Required actionApply updates per vendor instructions.
A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
Pulse SecurePulse Connect Secure
Required actionApply updates per vendor instructions.
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
MozillaFirefox
Required actionApply updates per vendor instructions.
A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
OracleJava SE
Required actionApply updates per vendor instructions.
An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
OracleJava SE
Required actionApply updates per vendor instructions.
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
OracleJava SE JDK and JRE
Required actionApply updates per vendor instructions.
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
ApacheTomcat
Required actionApply updates per vendor instructions.
An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
AdobeColdFusion
Required actionApply updates per vendor instructions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
OracleJava SE
Required actionApply updates per vendor instructions.
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
AdobeAcrobat and Reader
Required actionApply updates per vendor instructions.
A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
AdobeReader and Acrobat
Required actionApply updates per vendor instructions.
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
MicrosoftOffice
Required actionApply updates per vendor instructions.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
CiscoSmall Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Required actionApply updates per vendor instructions.
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
AdobeReader and Acrobat
Required actionApply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
CiscoSmall Business RV160, RV260, RV340, and RV345 Series Routers
Required actionApply updates per vendor instructions.
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
AdobeReader and Acrobat
Required actionApply updates per vendor instructions.
Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.
MicrosoftOffice
Required actionApply updates per vendor instructions.
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
MicrosoftExcel
Required actionApply updates per vendor instructions.
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
MicrosoftWindows
Required actionApply updates per vendor instructions.
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
MicrosoftOffice
Required actionApply updates per vendor instructions.
Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.
MicrosoftOffice
Required actionApply updates per vendor instructions.
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.
MicrosoftOffice
Required actionApply updates per vendor instructions.
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
MicrosoftMalware Protection Engine
Required actionApply updates per vendor instructions.
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
CiscoIOS and IOS XE Software
Required actionApply updates per vendor instructions.
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
MicrosoftForefront Threat Management Gateway (TMG)
Required actionApply updates per vendor instructions.
Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.
MicrosoftOffice
Required actionApply updates per vendor instructions.