CISA: CVE Program partner

No CVE published under this name.

Organisation	Cybersecurity and Infrastructure Security Agency (CISA)
Role	Top-Level Root, ADP
Type	-
Reports to	-
Scope	<strong>Top-Level Root Scope:</strong> Vulnerabilities that are (1) reported to or observed by CISA and (2) affect critical infrastructure, U.S. civilian government, industrial control systems, or medical devices, and (3) are not covered by another CNA’s scope.<br/><strong>ADP Scope:</strong> View scope <a href='/ProgramOrganization/ADPs#ActiveAdps'>here</a>.
Advisories	https://www.cisa.gov/news-events/cybersecurity-advisories

Partner	CVEs 1y	90 days	Quality	CVSS	CWE	Versions	CVSS by CISA	Last
icscert Root CNA-LR Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) · CERT	585	235	99%	100%	99%	100%	0%	2026-10-16
cisa-cg Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · CERT	168	105	100%	100%	100%	100%	0%	2026-10-05

CVE-2026-107777 2026-10-16 · icscert · CVSS 6.5
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Serve
CVE-2026-105667 2026-10-16 · icscert · CVSS 7.5
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassi
CVE-2026-105279 2026-10-16 · icscert · CVSS 9.1
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and re
CVE-2026-101021 2026-10-16 · icscert · CVSS 7.5
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and
CVE-2026-105273 2026-10-16 · icscert · CVSS 7.5
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
CVE-2026-107621 2026-10-16 · icscert · CVSS 7.5
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
CVE-2026-97851 2026-10-16 · icscert · CVSS 9.1
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a locati
CVE-2026-105664 2026-10-16 · icscert · CVSS 5.3
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response c
CVE-2026-97858 2026-10-16 · icscert · CVSS 5.3
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is
CVE-2026-107617 2026-10-16 · icscert · CVSS 9.8
An attacker can use a hard-coded credential to log in to EseeCloud devices.
CVE-2026-107564 2026-10-16 · CERTVDE · CVSS 8.7
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leadi
CVE-2026-109813 2026-10-16 · Moxa · CVSS 8.6
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with a
CVE-2026-109812 2026-10-16 · Moxa · CVSS 6.9
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authentica
CVE-2026-105228 2026-10-16 · Deltaww · CVSS 7.0
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVE-2026-105227 2026-10-16 · Deltaww · CVSS 7.0
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVE-2026-110936 2026-10-15 · siemens · CVSS 6.7
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an u
CVE-2026-17525 2026-10-15 · ABB · CVSS 5.2
Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
CVE-2026-92817 2026-10-13 · icscert · CVSS 8.8
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vis
CVE-2026-107607 2026-10-13 · icscert · CVSS 6.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
CVE-2026-107606 2026-10-13 · icscert · CVSS 6.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
CVE-2026-107605 2026-10-13 · icscert · CVSS 5.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
CVE-2026-65200 2026-10-13 · runZero · CVSS 3.5
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transpor
CVE-2026-65199 2026-10-13 · runZero · CVSS 5.4
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapp
CVE-2026-65198 2026-10-13 · runZero · CVSS 8.6
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the op
CVE-2026-65197 2026-10-13 · runZero · CVSS 3.1
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by

All CVE Program partners

CISA

Reports to CISA (2)

Latest CVEs (this partner and the CNAs under it) · RSS