CVE Program partner

cisa-cg

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

API
CVEs, 365 days168270 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
RoleCNA
TypeCERT
Reports toCISA
ScopeVulnerabilities that are (1) reported to or observed by CISA, (2) affect critical infrastructure or U.S. civilian government, and (3) are not covered by another CNA’s scope.
Advisorieshttps://www.cisa.gov/news-events/cybersecurity-advisories

Latest CVEs · RSS

  • CVE-2026-105773 2026-10-05 · CVSS 7.3
    Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and i
  • CVE-2026-102262 2026-10-05 · CVSS 7.0
    Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside mal
  • CVE-2026-101893 2026-10-05 · CVSS 4.4
    Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every reco
  • CVE-2026-102628 2026-10-01 · CVSS 9.3
    The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An u
  • CVE-2026-100251 2026-10-01 · CVSS 6.5
    Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated atta
  • CVE-2026-102671 2026-10-01 · CVSS 5.3
    The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.
  • CVE-2026-102670 2026-10-01 · CVSS 5.3
    Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
  • CVE-2026-102669 2026-10-01 · CVSS 5.3
    Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.
  • CVE-2026-102668 2026-10-01 · CVSS 6.9
    The Joyland AI app accepts any TLS certificates from any server without validation.
  • CVE-2026-102667 2026-10-01 · CVSS 9.0
    Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker
  • CVE-2026-82358 2026-10-01 · CVSS 6.5
    RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly
  • CVE-2026-102666 2026-10-01 · CVSS 6.5
    The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push noti
  • CVE-2026-82357 2026-10-01 · CVSS 6.5
    RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may
  • CVE-2026-102105 2026-09-30 · CVSS 9.1
    Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Ki
  • CVE-2026-102106 2026-09-30 · CVSS 9.1
    Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not
  • CVE-2026-102107 2026-09-30 · CVSS 4.6
    Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate fro
  • CVE-2026-102108 2026-09-30 · CVSS 7.2
    An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deseria
  • CVE-2026-102109 2026-09-30 · CVSS 7.1
    A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated i
  • CVE-2026-102110 2026-09-30 · CVSS 5.9
    An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the init
  • CVE-2026-102111 2026-09-30 · CVSS 4.9
    Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside it
  • CVE-2026-102112 2026-09-30 · CVSS 7.8
    A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on
  • CVE-2026-102113 2026-09-30 · CVSS 7.8
    A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on
  • CVE-2026-102114 2026-09-30 · CVSS 7.2
    A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root
  • CVE-2026-102115 2026-09-30 · CVSS 9.8
    Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user
  • CVE-2026-102116 2026-09-30 · CVSS 7.2
    -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the app

All CVE Program partners