CASCACascade Atlas

Authoritative signal

Known exploited

The current CISA KEV catalog, bound to the current snapshot and ordered by catalog date and CASCA priority.

Evidence through Oct 22, 2026, 6:07 PM UTC
CISA KEV catalog boundaryCatalog silence leaves exploitation status unassessed. Alternate serialization never counts as a second source.1,754 catalog members · showing 151–200
151
CVE-2026-8398CISA KEVSource-reported scopeEvidence supported

Daemon Tools Lite Embedded Malicious Code Vulnerability

Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

DaemonDaemon Tools Lite

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-27
Due
2026-05-30
Priority interval
67.9–69.4
Coverage
93%
↗
152
CVE-2026-48172CISA KEVSource-reported scopeEvidence supported

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

LiteSpeedcPanel Plugin

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-26
Due
2026-05-29
Priority interval
67.0–73.1
Coverage
85%
↗
153
CVE-2026-9082CISA KEVSource-reported scopeEvidence supported

Drupal Core SQL Injection Vulnerability

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

DrupalCore

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-22
Due
2026-05-27
Priority interval
72.4–80.3
Coverage
85%
↗
154
CVE-2025-34291CISA KEVSource-reported scopeEvidence supported

Langflow Origin Validation Error Vulnerability

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

LangflowLangflow

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-21
Due
2026-06-04
Priority interval
82.8–87.0
Coverage
85%
↗
155
CVE-2026-34926CISA KEVSource-reported scopeEvidence supported

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

Trend MicroApex One

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-21
Due
2026-06-04
Priority interval
58.2–64.3
Coverage
85%
↗
156
CVE-2008-4250CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Buffer Overflow Vulnerability

Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
89.9–90.9
Coverage
99%
↗
157
CVE-2009-3459CISA KEVSource-reported scopeEvidence supported

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

AdobeAcrobat and Reader

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
85.4–86.7
Coverage
98%
↗
158
CVE-2010-0806CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

MicrosoftInternet Explorer

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
84.0–85.6
Coverage
98%
↗
159
CVE-2010-0249CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

MicrosoftInternet Explorer

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
83.8–85.4
Coverage
98%
↗
160
CVE-2009-1537CISA KEVSource-reported scopeEvidence supported

Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

MicrosoftDirectX

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
82.6–83.6
Coverage
99%
↗
161
CVE-2026-45498CISA KEVAssessments differAssessments differSource-reported scope

Microsoft Defender Denial of Service Vulnerability

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
Resolve conflict
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
52.3–65.2
Coverage
73%
↗
162
CVE-2026-41091CISA KEVSource-reported scopeEvidence supported

Microsoft Defender Link Following Vulnerability

Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-20
Due
2026-06-03
Priority interval
60.8–65.0
Coverage
85%
↗
163
CVE-2026-42897CISA KEVAssessments differAssessments differSource-reported scope

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

MicrosoftMicrosoft

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
Resolve conflict
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-15
Due
2026-05-29
Priority interval
60.2–68.8
Coverage
86%
↗
164
CVE-2026-20182CISA KEVSource-reported scopeEvidence supported

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

CiscoCatalyst SD-WAN

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-14
Due
2026-05-17
Priority interval
88.3–90.3
Coverage
99%
↗
165
CVE-2026-42208CISA KEVSource-reported scopeEvidence supported

BerriAI LiteLLM SQL Injection Vulnerability

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

BerriAILiteLLM

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-08
Due
2026-05-11
Priority interval
70.7–75.5
Coverage
88%
↗
166
CVE-2026-6973CISA KEVSource-reported scopeEvidence supported

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

IvantiEndpoint Manager Mobile (EPMM)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-07
Due
2026-05-10
Priority interval
63.8–65.4
Coverage
96%
↗
167
CVE-2026-0300CISA KEVAssessments differAssessments differSource-reported scope

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Palo Alto NetworksPAN-OS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
Resolve conflict
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-06
Due
2026-05-09
Priority interval
77.2–81.9
Coverage
87%
↗
168
CVE-2026-31431CISA KEVSource-reported scopeEvidence supported

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

LinuxKernel

Required action"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-05-01
Due
2026-05-15
Priority interval
63.2–78.2
Coverage
85%
↗
169
CVE-2026-41940CISA KEVKnown ransomwareSource-reported scopeEvidence supported

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

WebProscPanel & WHM and WP2 (WordPress Squared)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-30
Due
2026-05-03
Priority interval
83.1–94.9
Coverage
85%
↗
170
CVE-2024-1708CISA KEVKnown ransomwareSource-reported scopeEvidence supported

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

ConnectWiseScreenConnect

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-28
Due
2026-05-12
Priority interval
83.2–84.7
Coverage
93%
↗
171
CVE-2026-32202CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Protection Mechanism Failure Vulnerability

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-28
Due
2026-05-12
Priority interval
55.2–68.5
Coverage
85%
↗
172
CVE-2024-7399CISA KEVAssessments differAssessments differSource-reported scope

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

SamsungMagicINFO 9 Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
Resolve conflict
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-24
Due
2026-05-08
Priority interval
81.2–87.9
Coverage
73%
↗
173
CVE-2024-57726CISA KEVKnown ransomwareSource-reported scopeEvidence supported

SimpleHelp Missing Authorization Vulnerability

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

SimpleHelp SimpleHelp

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-24
Due
2026-05-08
Priority interval
83.7–85.2
Coverage
93%
↗
174
CVE-2025-29635CISA KEVSource-reported scopeEvidence supported

D-Link DIR-823X Command Injection Vulnerability

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

D-LinkDIR-823X

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-24
Due
2026-05-08
Priority interval
79.4–80.9
Coverage
95%
↗
175
CVE-2024-57728CISA KEVKnown ransomwareSource-reported scopeEvidence supported

SimpleHelp Path Traversal Vulnerability

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

SimpleHelp SimpleHelp

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-24
Due
2026-05-08
Priority interval
76.7–78.2
Coverage
93%
↗
176
CVE-2026-39987CISA KEVSource-reported scopeEvidence supported

Marimo Remote Code Execution Vulnerability

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

MarimoMarimo

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-23
Due
2026-05-07
Priority interval
78.2–79.7
Coverage
93%
↗
177
CVE-2026-33825CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

MicrosoftDefender

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-22
Due
2026-05-06
Priority interval
60.8–64.9
Coverage
85%
↗
178
CVE-2023-27351CISA KEVKnown ransomwareSource-reported scopeEvidence supported

PaperCut NG/MF Improper Authentication Vulnerability

PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

PaperCutNG/MF

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-05-04
Priority interval
76.4–84.3
Coverage
85%
↗
179
CVE-2024-27199CISA KEVKnown ransomwareSource-reported scopeEvidence supported

JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

JetBrainsTeamCity

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-05-04
Priority interval
80.9–82.4
Coverage
93%
↗
180
CVE-2026-20133CISA KEVAssessments differAssessments differSource-reported scope

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

CiscoCatalyst SD-WAN Manager

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
Resolve conflict
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-04-23
Priority interval
70.3–74.3
Coverage
85%
↗
181
CVE-2025-32975CISA KEVSource-reported scopeEvidence supported

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

QuestKACE Systems Management Appliance (SMA)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-05-04
Priority interval
70.8–72.3
Coverage
98%
↗
182
CVE-2026-20128CISA KEVSource-reported scopeEvidence supported

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

CiscoCatalyst SD-WAN Manager

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-04-23
Priority interval
66.8–68.3
Coverage
98%
↗
183
CVE-2026-20122CISA KEVSource-reported scopeEvidence supported

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

CiscoCatalyst SD-WAN Manger

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-04-23
Priority interval
66.2–67.8
Coverage
98%
↗
184
CVE-2025-2749CISA KEVSource-reported scopeEvidence supported

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.

KenticoKentico Xperience

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-05-04
Priority interval
64.7–66.2
Coverage
93%
↗
185
CVE-2025-48700CISA KEVSource-reported scopeEvidence supported

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

SynacorZimbra Collaboration Suite (ZCS)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-20
Due
2026-04-23
Priority interval
60.5–62.1
Coverage
100%
↗
186
CVE-2026-34197CISA KEVSource-reported scopeEvidence supported

Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

ApacheActiveMQ

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-16
Due
2026-04-30
Priority interval
69.9–80.7
Coverage
85%
↗
187
CVE-2009-0238CISA KEVSource-reported scopeEvidence supported

Microsoft Office Remote Code Execution

Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

MicrosoftOffice

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-14
Due
2026-04-28
Priority interval
81.4–82.4
Coverage
99%
↗
188
CVE-2026-32201CISA KEVSource-reported scopeEvidence supported

Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

MicrosoftSharePoint Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-14
Due
2026-04-28
Priority interval
72.1–75.6
Coverage
93%
↗
189
CVE-2026-21643CISA KEVSource-reported scopeEvidence supported

Fortinet FortiClient EMS SQL Injection Vulnerability

Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

FortinetFortiClient EMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-16
Priority interval
86.5–88.1
Coverage
93%
↗
190
CVE-2023-21529CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

MicrosoftExchange Server

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
77.4–85.8
Coverage
85%
↗
191
CVE-2023-36424CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Out-of-Bounds Read Vulnerability

Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
73.5–79.4
Coverage
92%
↗
192
CVE-2020-9715CISA KEVSource-reported scopeEvidence supported

Adobe Acrobat Use-After-Free Vulnerability

Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

AdobeAcrobat

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
74.6–75.9
Coverage
98%
↗
193
CVE-2026-34621CISA KEVSource-reported scopeEvidence supported

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

AdobeAcrobat and Reader

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
64.5–72.4
Coverage
85%
↗
194
CVE-2025-60710CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows Link Following Vulnerability

Microsoft Windows contains a link following vulnerability that allows for privilege escalation

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
63.8–71.7
Coverage
85%
↗
195
CVE-2012-1854CISA KEVSource-reported scopeEvidence supported

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.

MicrosoftVisual Basic for Applications (VBA)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-13
Due
2026-04-27
Priority interval
70.5–71.7
Coverage
99%
↗
196
CVE-2026-1340CISA KEVSource-reported scopeEvidence supported

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

IvantiEndpoint Manager Mobile (EPMM)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-08
Due
2026-04-11
Priority interval
87.0–88.5
Coverage
93%
↗
197
CVE-2026-35616CISA KEVSource-reported scopeEvidence supported

Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

FortinetFortiClient EMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-06
Due
2026-04-09
Priority interval
83.9–89.2
Coverage
85%
↗
198
CVE-2026-3502CISA KEVSource-reported scopeEvidence supported

TrueConf Client Download of Code Without Integrity Check Vulnerability

TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

TrueConfClient

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-02
Due
2026-04-16
Priority interval
63.3–64.8
Coverage
93%
↗
199
CVE-2026-5281CISA KEVSource-reported scopeEvidence supported

Google Dawn Use-After-Free Vulnerability

Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

GoogleDawn

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-04-01
Due
2026-04-15
Priority interval
63.7–67.9
Coverage
85%
↗
200
CVE-2026-3055CISA KEVSource-reported scopeEvidence supported

Citrix NetScaler Out-of-Bounds Read Vulnerability

Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.

CitrixNetScaler

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Evidence reason details
Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
Review source contract
Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Resolution
None
Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Resolution
None
Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision
casca-factor-d-obligations-v1
Cutoff
Resolution
Resolve identity
Added
2026-03-30
Due
2026-04-02
Priority interval
70.8–73.0
Coverage
96%
↗