CVE Program partner

ivanti

Ivanti

API
CVEs, 365 days51213 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationIvanti
RoleCNA
TypeVendor
Reports tomitre
ScopeVulnerabilities in supported Ivanti products and infrastructure, excluding third-party components, and meeting severity thresholds defined in Ivanti’s Disclosure Policy found <a href='https://www.ivanti.com/support/contact-security' target='_blank'>here</a>.
Advisorieshttps://www.ivanti.com/blog/topics/security-advisory

Latest CVEs · RSS

  • CVE-2026-109412 2026-10-13 · CVSS 9.9
    An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
  • CVE-2026-106047 2026-10-13 · CVSS 7.7
    A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arb
  • CVE-2026-106043 2026-10-13 · CVSS 7.5
    A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modif
  • CVE-2026-106042 2026-10-13 · CVSS 9.9
    An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-
  • CVE-2026-106035 2026-10-13 · CVSS 5.5
    An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose
  • CVE-2026-106034 2026-10-13 · CVSS 5.0
    A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the hos
  • CVE-2026-104935 2026-10-13 · CVSS 8.6
    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact IC
  • CVE-2026-12647 2026-09-08 · CVSS 9.9
    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
  • CVE-2026-12646 2026-09-08 · CVSS 9.9
    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
  • CVE-2026-12645 2026-09-08 · CVSS 9.9
    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
  • CVE-2026-83527 2026-09-08 · CVSS 8.1
    An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level acces
  • CVE-2026-12648 2026-09-08 · CVSS 8.8
    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on t
  • CVE-2026-12650 2026-09-08 · CVSS 9.9
    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on t
  • CVE-2026-12651 2026-09-08 · CVSS 8.8
    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on t
  • CVE-2026-12745 2026-09-08 · CVSS 9.8
    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on
  • CVE-2026-12744 2026-09-08 · CVSS 9.8
    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on
  • CVE-2026-18851 2026-09-08 · CVSS 8.8
    Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate thei
  • CVE-2026-18129 2026-08-11 · CVSS 8.1
    Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MIT
  • CVE-2026-18127 2026-08-11 · CVSS 7.7
    External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an
  • CVE-2026-18125 2026-08-11 · CVSS 7.5
    An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
  • CVE-2026-14903 2026-07-14 · CVSS 7.7
    Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
  • CVE-2026-14902 2026-07-14 · CVSS 4.0
    An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
  • CVE-2026-10727 2026-06-09 · CVSS 7.2
    An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary
  • CVE-2026-10523 2026-06-09 · CVSS 9.9
    An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to c
  • CVE-2026-10520 2026-06-09 · CVSS 10.0
    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-lev

All CVE Program partners