Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
MicrosoftMSHTML
Required actionApply updates per vendor instructions.
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
BQEBillQuick Web Suite
Required actionApply updates per vendor instructions.
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
DotNetNuke (DNN)DotNetNuke (DNN)
Required actionApply updates per vendor instructions.
IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
IBMData Risk Manager
Required actionApply updates per vendor instructions.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
AdobeColdFusion
Required actionApply updates per vendor instructions.
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
AdobeAcrobat and Reader
Required actionApply updates per vendor instructions.
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
ApacheStruts
Required actionApply updates per vendor instructions.
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
NagiosNagios XI
Required actionApply updates per vendor instructions.
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
AccellionFTA
Required actionApply updates per vendor instructions.
Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
IvantiPulse Connect Secure and Pulse Policy Secure
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.
D-LinkDIR-825 R1 Devices
Required actionApply updates per vendor instructions.
Netgear JGS516PE devices contain a missing function level access control vulnerability.
NETGEARJGS516PE Devices
Required actionApply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
MicrosoftExchange Server
Required actionApply updates per vendor instructions.
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
Microsoft.NET Framework, SharePoint, Visual Studio
Required actionApply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
MicrosoftExchange Server
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
CiscoAdaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Required actionApply updates per vendor instructions.
SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
SonicWallSMA100
Required actionApply updates per vendor instructions.
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
CiscoAdaptive Security Appliance (ASA)
Required actionApply updates per vendor instructions.
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.
CiscoSmall Business RV320 and RV325 Routers
Required actionApply updates per vendor instructions.
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
IvantiPulse Connect Secure
Required actionApply updates per vendor instructions.
Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.
MicrosoftWindows
Required actionApply updates per vendor instructions.
The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.
ApacheSolr
Required actionApply updates per vendor instructions.
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
FortinetFortiOS
Required actionApply updates per vendor instructions.
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
WordPressSnap Creek Duplicator Plugin
Required actionApply updates per vendor instructions.
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
EyesOfNetworkEyesOfNetwork
Required actionApply updates per vendor instructions.
IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
IBMData Risk Manager
Required actionApply updates per vendor instructions.
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
AdobeFlash Player
Required actionThe impacted product is end-of-life and should be disconnected if still in use.
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
AdobeAcrobat and Reader
Required actionApply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
MicrosoftExchange Server
Required actionApply updates per vendor instructions.
TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.
TVTNVMS-1000
Required actionApply updates per vendor instructions.
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
GoogleChrome FreeType
Required actionApply updates per vendor instructions.
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.
UnraidUnraid
Required actionApply updates per vendor instructions.
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
SophosSFOS
Required actionApply updates per vendor instructions.
Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.
MicrosoftMSHTML
Required actionApply updates per vendor instructions.
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
IvantiPulse Connect Secure
Required actionApply updates per vendor instructions.
Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.
MicrosoftInternet Explorer
Required actionApply updates per vendor instructions.
Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
SonicWallSSLVPN SMA100
Required actionApply updates per vendor instructions.