CISA Known Exploited Vulnerabilities

Linux Kernel Linux Kernel Out-of-Bounds Write Vulnerability CVE-2022-0995 Past due Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-8452 Past due Microsoft SQL Server Microsoft SQL Server Remote Code Execution Vulnerability CVE-2019-1068 Past due Gitea Gitea Gitea Code Injection Vulnerability CVE-2026-60004 Past due Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CVE-2026-21962 Past due Synacor Zimbra Collaboration Suite (ZCS) Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability CVE-2026-73570 Past due TrueConf Server TrueConf Server Code Injection Vulnerability CVE-2026-72530 Past due TrueConf Server TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72529 Past due MLflow MLflow MLflow Server-Side Request Forgery Vulnerability CVE-2026-64849 Past due Microsoft Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-33824 Past due Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-59310 Ransomware Microsoft SharePoint Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-55040 Past due Apple macOS Apple macOS Improper Authentication Vulnerability CVE-2026-65400 Past due Ray-Project Ray Ray-Project Ray Code Injection Vulnerability CVE-2025-62593 Past due Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability CVE-2026-20349 Past due Microsoft Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability CVE-2026-68820 Past due Metabase Metabase Metabase SQL Injection Vulnerability CVE-2026-72898 Past due Progress LoadMaster Progress LoadMaster Command Injection Vulnerability CVE-2026-8037 Past due JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CVE-2026-63077 Ransomware N-able N-central N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18556 Past due Apache Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 Past due IBM Langflow IBM Langflow Code Injection Vulnerability CVE-2026-9198 Past due N-able N-central N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18577 Past due Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability CVE-2026-20316 Ransomware Fortinet FortiOS Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability CVE-2025-68686 Past due Arista VeloCloud Orchestrator Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability CVE-2026-16812 Past due Check Point SmartConsole Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-16232 Past due Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-50522 Past due WordPress Core WordPress Core SQL Injection Vulnerability CVE-2026-60137 Past due WordPress Core WordPress Core Interpretation Conflict Vulnerability CVE-2026-63030 Past due Langflow Langflow Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-0770 Past due DD-WRT DD-WRT DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2021-27137 Past due Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644 Past due Fortinet FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-25089 Past due Fortinet FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808 Past due Oracle E-Business Suite Oracle E-Business Suite Improper Privilege Management Vulnerability CVE-2026-46817 Past due KNX Association KNX Protocol Connection Authorization Option 1 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability CVE-2023-4346 Past due Microsoft Active Directory Federation Services Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 Past due Microsoft SharePoint Server Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability CVE-2026-56164 Past due SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-15409 Ransomware SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability CVE-2026-15410 Ransomware Cisco IOS Cisco IOS Cross-Site Request Forgery Vulnerability CVE-2008-4128 Past due Balbooa Forms Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 Past due iCagenda iCagenda iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48939 Past due JoomShaper SP Page Builder JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48908 Past due Langflow Langflow Langflow Authorization Bypass Through User-Controlled Key Vulnerability CVE-2026-55255 Past due Joomlack Page Builder Joomlack Page Builder Improper Access Control Vulnerability CVE-2026-56290 Past due Adobe ColdFusion Adobe ColdFusion Path Traversal Vulnerability CVE-2026-48282 Past due Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability CVE-2026-45659 Ransomware SimpleHelp SimpleHelp SimpleHelp Authentication Bypass Vulnerability CVE-2026-48558 Past due