Authoritative signal
The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
IvantiPulse Connect Secure
Required actionApply updates per vendor instructions.
Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
AppleiOS
Required actionApply updates per vendor instructions.
Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium V8
Required actionApply updates per vendor instructions.
Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
CiscoIOS XR
Required actionApply updates per vendor instructions.
Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
MozillaFirefox and Thunderbird
Required actionApply updates per vendor instructions.
Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium
Required actionApply updates per vendor instructions.
Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
CiscoIOS XR
Required actionApply updates per vendor instructions.
Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
AppleiOS, iPadOS, and watchOS
Required actionApply updates per vendor instructions.
VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
VMwareMultiple Products
Required actionApply updates per vendor instructions.
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
FortinetFortiOS
Required actionApply updates per vendor instructions.
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
MicrosoftOffice
Required actionApply updates per vendor instructions.
Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.
ApplemacOS
Required actionApply updates per vendor instructions.
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
MozillaFirefox and Thunderbird
Required actionApply updates per vendor instructions.
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
SolarWindsVirtualization Manager
Required actionApply updates per vendor instructions.
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
AccellionFTA
Required actionApply updates per vendor instructions.
Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.
QualcommMultiple Chipsets
Required actionApply updates per vendor instructions.
Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."
AndroidAndroid Kernel
Required actionApply updates per vendor instructions.
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftEnhanced Cryptographic Provider
Required actionApply updates per vendor instructions.
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Trend MicroApex One, OfficeScan, and Worry-Free Business Security
Required actionApply updates per vendor instructions.
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftEnhanced Cryptographic Provider
Required actionApply updates per vendor instructions.
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
McAfeeMcAfee Total Protection (MTP)
Required actionApply updates per vendor instructions.
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
MicrosoftOpen Management Infrastructure (OMI)
Required actionApply updates per vendor instructions.
Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
MicrosoftWin32k
Required actionApply updates per vendor instructions.
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
MicrosoftOpen Management Infrastructure (OMI)
Required actionApply updates per vendor instructions.
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
MicrosoftEdge and Internet Explorer
Required actionApply updates per vendor instructions.
Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.
AppleiOS and macOS
Required actionApply updates per vendor instructions.
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Trend MicroApex One, Apex One as a Service, and Worry-Free Business Security
Required actionApply updates per vendor instructions.
Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.
MicrosoftWindows
Required actionApply updates per vendor instructions.
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
TeamViewerDesktop
Required actionApply updates per vendor instructions.
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
MediaTekMultiple Chipsets
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
AppleMultiple Products
Required actionApply updates per vendor instructions.
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
AppleiOS, iPadOS, and watchOS
Required actionApply updates per vendor instructions.
Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
AppleMultiple Products
Required actionApply updates per vendor instructions.
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
GoogleChromium Intents
Required actionApply updates per vendor instructions.
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
ArmTrusted Firmware
Required actionApply updates per vendor instructions.
Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
QualcommMultiple Chipsets
Required actionApply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
AppleiOS, iPadOS, and watchOS
Required actionApply updates per vendor instructions.