Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.
Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.
| CVE | Vendor | Product | Vulnerability | CVSS | Added | Federal due date | BOD 26-04 | Ransomware |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-76418 | Cisco | Secure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | 8.6 CNA | 2026-10-29 | 2026-11-01 | 3 days automatable · partial | Unknown |
| CVE-2026-96654 | Plex | Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. | 6.9 CNA | 2026-10-20 | 2026-10-23 | 3 days automatable · partial | Unknown |
| CVE-2026-105133 | Ahsay | AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. | 6.9 CNA | 2026-10-14 | 2026-10-17 | 3 days automatable · partial | Unknown |
| CVE-2015-5477 | ISC | BIND | ISC BIND Data Processing Errors Vulnerability ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. | 7.5 CISA | 2026-10-08 | 2026-10-11 | 3 days automatable · partial | Unknown |
| CVE-2026-88779 | Citrix | NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. | 8.7 CNA | 2026-10-04 | 2026-10-07 | 3 days automatable · partial | Unknown |
| CVE-2026-67279 | MikroTik | RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. | 6.9 CNA | 2026-09-25 | 2026-09-28 | 3 days automatable · partial | Unknown |
| CVE-2026-42018 | JFrog | Artifactory | JFrog Artifactory Improper Authentication Vulnerability JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | 7.5 CNA | 2026-09-11 | 2026-09-25 | 3 days automatable · partial | Unknown |
| CVE-2026-67277 | MikroTik | RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. | 8.8 CNA | 2026-09-10 | 2026-09-13 | 3 days automatable · partial | Unknown |
| CVE-2026-59822 | BerriAI | LiteLLM | BerriAI LiteLLM Improper Authentication Vulnerability BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. | 8.8 CNA | 2026-09-02 | 2026-09-16 | 3 days automatable · partial | Unknown |
| CVE-2026-81578 | PaperCut | NG/MF | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. | 8.8 CNA | 2026-08-31 | 2026-09-14 | 3 days automatable · partial | Unknown |
| CVE-2026-8452 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. | 8.8 CNA | 2026-08-26 | 2026-08-29 | 3 days automatable · partial | Unknown |
| CVE-2026-20349 | Cisco | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | 8.6 CNA | 2026-08-11 | 2026-08-14 | 3 days automatable · partial | Unknown |
| CVE-2026-34486 | Apache | Tomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. | 7.5 CISA | 2026-08-04 | 2026-08-07 | 3 days automatable · partial | Unknown |
| CVE-2026-20316 | Cisco | Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. | 5.3 CNA | 2026-07-29 | 2026-08-01 | 3 days automatable · partial | Known |
| CVE-2023-4346 | KNX Association | KNX Protocol Connection Authorization Option 1 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. | 7.5 CNA | 2026-07-15 | 2026-07-29 | 3 days automatable · partial | Unknown |
| CVE-2026-56164 | Microsoft | SharePoint | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. | 5.3 CNA | 2026-07-14 | 2026-07-17 | 3 days automatable · partial | Unknown |
| CVE-2026-28318 | SolarWinds | Serv-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. | 7.5 CNA | 2026-06-05 | 2026-06-19 | 3 days automatable · partial | Unknown |
| CVE-2024-21182 | Oracle | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. | 7.5 CNA | 2026-06-01 | 2026-06-04 | 3 days automatable · partial | Unknown |
| CVE-2024-27199 | JetBrains | TeamCity | JetBrains TeamCity Relative Path Traversal Vulnerability JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. | 7.3 CNA | 2026-04-20 | 2026-05-04 | 3 days automatable · partial | Known |
| CVE-2023-27351 | PaperCut | NG/MF | PaperCut NG/MF Improper Authentication Vulnerability PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class. | 8.2 CNA | 2026-04-20 | 2026-05-04 | 3 days automatable · partial | Known |
| CVE-2026-32201 | Microsoft | SharePoint | Microsoft SharePoint Server Improper Input Validation Vulnerability Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. | 6.5 CNA | 2026-04-14 | 2026-04-28 | 3 days automatable · partial | Unknown |
| CVE-2021-22054 | Omnissa | Workspace One UEM | Omnissa Workspace ONE Server-Side Request Forgery Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. | 7.5 CISA | 2026-03-09 | 2026-03-23 | 3 days automatable · partial | Unknown |
| CVE-2025-68461 | Roundcube | Webmail | RoundCube Webmail Cross-site Scripting Vulnerability RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. | 7.2 CNA | 2026-02-20 | 2026-03-13 | 3 days automatable · partial | Unknown |
| CVE-2025-34026 | Versa | Concerto | Versa Concerto Improper Authentication Vulnerability Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs. | 9.2 CNA | 2026-01-22 | 2026-02-12 | 3 days automatable · partial | Unknown |
| CVE-2025-14847 | MongoDB | MongoDB and MongoDB Server | MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client. | 8.7 CNA | 2025-12-29 | 2026-01-19 | 3 days automatable · partial | Unknown |
| CVE-2025-58360 | OSGeo | GeoServer | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. | 8.2 CNA | 2025-12-11 | 2026-01-01 | 3 days automatable · partial | Unknown |
| CVE-2025-11371 | Gladinet | CentreStack and Triofox | Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. | 7.5 CISA | 2025-11-04 | 2025-11-25 | 3 days automatable · partial | Unknown |
| CVE-2025-61884 | Oracle | E-Business Suite | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. | 7.5 CNA | 2025-10-20 | 2025-11-10 | 3 days automatable · partial | Known |
| CVE-2021-43798 | Grafana Labs | Grafana | Grafana Path Traversal Vulnerability Grafana contains a path traversal vulnerability that could allow access to local files. | 7.5 CNA | 2025-10-09 | 2025-10-30 | 3 days automatable · partial | Unknown |
| CVE-2021-21311 | Adminer | Adminer | Adminer Server-Side Request Forgery Vulnerability Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. | 7.2 CNA | 2025-09-29 | 2025-10-20 | 3 days automatable · partial | Unknown |
| CVE-2025-20362 | Cisco | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. | 6.5 CNA | 2025-09-25 | 2025-09-26 | 3 days automatable · partial | Unknown |
| CVE-2020-25078 | D-Link | DCS-2530L and DCS-2670L Devices | D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | 7.5 CISA | 2025-08-05 | 2025-08-26 | 3 days automatable · partial | Unknown |
| CVE-2025-2776 | SysAid | SysAid On-Prem | SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. | 9.3 CNA | 2025-07-22 | 2025-08-12 | 3 days automatable · partial | Unknown |
| CVE-2025-2775 | SysAid | SysAid On-Prem | SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. | 9.3 CNA | 2025-07-22 | 2025-08-12 | 3 days automatable · partial | Unknown |
| CVE-2019-5418 | Rails | Ruby on Rails | Rails Ruby on Rails Path Traversal Vulnerability Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. | 7.5 CISA | 2025-07-07 | 2025-07-28 | 3 days automatable · partial | Unknown |
| CVE-2019-9621 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component. | 7.5 CISA | 2025-07-07 | 2025-07-28 | 3 days automatable · partial | Unknown |
| CVE-2025-48927 | TeleMessage | TM SGNL | TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI. | 5.3 CNA | 2025-07-01 | 2025-07-22 | 3 days automatable · partial | Unknown |
| CVE-2025-35939 | Craft CMS | Craft CMS | Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. | 5.3 CNA | 2025-06-02 | 2025-06-23 | 3 days automatable · partial | Unknown |
| CVE-2025-27920 | Srimax | Output Messenger | Srimax Output Messenger Directory Traversal Vulnerability Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. | 7.2 CNA | 2025-05-19 | 2025-06-09 | 3 days automatable · partial | Unknown |
| CVE-2023-38950 | ZKTeco | BioTime | ZKTeco BioTime Path Traversal Vulnerability ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload. | 7.5 CISA | 2025-05-19 | 2025-06-09 | 3 days automatable · partial | Unknown |
| CVE-2017-12637 | SAP | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. | 7.5 CISA | 2025-03-19 | 2025-04-09 | 3 days automatable · partial | Unknown |
| CVE-2025-30066 | tj-actions | changed-files GitHub Action | tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys. | 8.6 CNA | 2025-03-18 | 2025-04-08 | 3 days automatable · partial | Unknown |
| CVE-2022-43939 | Hitachi Vantara | Pentaho Business Analytics (BA) Server | Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization. | 8.6 CNA | 2025-03-03 | 2025-03-24 | 3 days automatable · partial | Unknown |
| CVE-2024-53704 | SonicWall | SonicOS | SonicWall SonicOS SSLVPN Improper Authentication Vulnerability SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. | 8.2 CISA | 2025-02-18 | 2025-03-11 | 3 days automatable · partial | Known |
| CVE-2025-0108 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. | 8.8 CNA | 2025-02-18 | 2025-03-11 | 3 days automatable · partial | Unknown |
| CVE-2024-29059 | Microsoft | .NET Framework | Microsoft .NET Framework Information Disclosure Vulnerability Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. | 7.5 CNA | 2025-02-04 | 2025-02-25 | 3 days automatable · partial | Unknown |
| CVE-2024-55550 | Mitel | MiCollab | Mitel MiCollab Path Traversal Vulnerability Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. | 4.4 CISA | 2025-01-07 | 2025-01-28 | 3 days automatable · partial | Known |
| CVE-2024-3393 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. | 8.7 CNA | 2024-12-30 | 2025-01-20 | 3 days automatable · partial | Unknown |
| CVE-2024-20767 | Adobe | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. | 7.4 CNA | 2024-12-16 | 2025-01-06 | 3 days automatable · partial | Unknown |
| CVE-2023-45727 | North Grid | Proself | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. | 7.5 CISA | 2024-12-03 | 2024-12-24 | 3 days automatable · partial | Unknown |