This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2025-9242
Vendor: WatchGuard
Product: Firebox
Added: 2025-11-12
Due Date: 2025-12-03
Description:
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-21042
Vendor: Samsung
Product: Mobile Devices
Added: 2025-11-10
Due Date: 2025-12-01
Description:
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-48703
Vendor: CWP
Product: Control Web Panel
Added: 2025-11-04
Due Date: 2025-11-25
Description:
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-11371
Vendor: Gladinet
Product: CentreStack and Triofox
Added: 2025-11-04
Due Date: 2025-11-25
Description:
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-41244
Vendor: Broadcom
Product: VMware Aria Operations and VMware Tools
Added: 2025-10-30
Due Date: 2025-11-20
Description:
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-24893
Vendor: XWiki
Product: Platform
Added: 2025-10-30
Due Date: 2025-11-20
Description:
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-6204
Vendor: Dassault Systèmes
Product: DELMIA Apriso
Added: 2025-10-28
Due Date: 2025-11-18
Description:
Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-6205
Vendor: Dassault Systèmes
Product: DELMIA Apriso
Added: 2025-10-28
Due Date: 2025-11-18
Description:
Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-54236
Vendor: Adobe
Product: Commerce and Magento
Added: 2025-10-24
Due Date: 2025-11-14
Description:
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-59287
Vendor: Microsoft
Product: Windows
Added: 2025-10-24
Due Date: 2025-11-14
Description:
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-61932
Vendor: Motex
Product: LANSCOPE Endpoint Manager
Added: 2025-10-22
Due Date: 2025-11-12
Description:
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2022-48503
Vendor: Apple
Product: Multiple Products
Added: 2025-10-20
Due Date: 2025-11-10
Description:
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-2746
Vendor: Kentico
Product: Xperience CMS
Added: 2025-10-20
Due Date: 2025-11-10
Description:
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-2747
Vendor: Kentico
Product: Xperience CMS
Added: 2025-10-20
Due Date: 2025-11-10
Description:
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-33073
Vendor: Microsoft
Product: Windows
Added: 2025-10-20
Due Date: 2025-11-10
Description:
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs: