This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2025-48543
Vendor: Android
Product: Runtime
Added: 2025-09-04
Due Date: 2025-09-25
Description:
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-53690
Vendor: Sitecore
Product: Multiple Products
Added: 2025-09-04
Due Date: 2025-09-25
Description:
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-50224
Vendor: TP-Link
Product: TL-WR841N
Added: 2025-09-03
Due Date: 2025-09-24
Description:
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-9377
Vendor: TP-Link
Product: Multiple Routers
Added: 2025-09-03
Due Date: 2025-09-24
Description:
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2020-24363
Vendor: TP-Link
Product: TL-WA855RE
Added: 2025-09-02
Due Date: 2025-09-23
Description:
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-55177
Vendor: Meta Platforms
Product: WhatsApp
Added: 2025-09-02
Due Date: 2025-09-23
Description:
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-57819
Vendor: Sangoma
Product: FreePBX
Added: 2025-08-29
Due Date: 2025-09-19
Description:
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-7775
Vendor: Citrix
Product: NetScaler
Added: 2025-08-26
Due Date: 2025-08-28
Description:
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-48384
Vendor: Git
Product: Git
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-8068
Vendor: Citrix
Product: Session Recording
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-8069
Vendor: Citrix
Product: Session Recording
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-43300
Vendor: Apple
Product: iOS, iPadOS, and macOS
Added: 2025-08-21
Due Date: 2025-09-11
Description:
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-54948
Vendor: Trend Micro
Product: Apex One
Added: 2025-08-18
Due Date: 2025-09-08
Description:
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-8876
Vendor: N-able
Product: N-Central
Added: 2025-08-13
Due Date: 2025-08-20
Description:
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-8875
Vendor: N-able
Product: N-Central
Added: 2025-08-13
Due Date: 2025-08-20
Description:
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.