This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2021-26829
Vendor: OpenPLC
Product: ScadaBR
Added: 2025-11-28
Due Date: 2025-12-19
Description:
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-61757
Vendor: Oracle
Product: Fusion Middleware
Added: 2025-11-21
Due Date: 2025-12-12
Description:
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-13223
Vendor: Google
Product: Chromium V8
Added: 2025-11-19
Due Date: 2025-12-10
Description:
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-58034
Vendor: Fortinet
Product: FortiWeb
Added: 2025-11-18
Due Date: 2025-11-25
Description:
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-64446
Vendor: Fortinet
Product: FortiWeb
Added: 2025-11-14
Due Date: 2025-11-21
Description:
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-12480
Vendor: Gladinet
Product: Triofox
Added: 2025-11-12
Due Date: 2025-12-03
Description:
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-62215
Vendor: Microsoft
Product: Windows
Added: 2025-11-12
Due Date: 2025-12-03
Description:
Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-9242
Vendor: WatchGuard
Product: Firebox
Added: 2025-11-12
Due Date: 2025-12-03
Description:
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-21042
Vendor: Samsung
Product: Mobile Devices
Added: 2025-11-10
Due Date: 2025-12-01
Description:
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-48703
Vendor: CWP
Product: Control Web Panel
Added: 2025-11-04
Due Date: 2025-11-25
Description:
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-11371
Vendor: Gladinet
Product: CentreStack and Triofox
Added: 2025-11-04
Due Date: 2025-11-25
Description:
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-41244
Vendor: Broadcom
Product: VMware Aria Operations and VMware Tools
Added: 2025-10-30
Due Date: 2025-11-20
Description:
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-24893
Vendor: XWiki
Product: Platform
Added: 2025-10-30
Due Date: 2025-11-20
Description:
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-6204
Vendor: Dassault Systèmes
Product: DELMIA Apriso
Added: 2025-10-28
Due Date: 2025-11-18
Description:
Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-6205
Vendor: Dassault Systèmes
Product: DELMIA Apriso
Added: 2025-10-28
Due Date: 2025-11-18
Description:
Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs: