This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2025-10585
Vendor: Google
Product: Chromium V8
Added: 2025-09-23
Due Date: 2025-10-14
Description:
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-5086
Vendor: Dassault Systèmes
Product: DELMIA Apriso
Added: 2025-09-11
Due Date: 2025-10-02
Description:
Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-38352
Vendor: Linux
Product: Kernel
Added: 2025-09-04
Due Date: 2025-09-25
Description:
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-48543
Vendor: Android
Product: Runtime
Added: 2025-09-04
Due Date: 2025-09-25
Description:
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-53690
Vendor: Sitecore
Product: Multiple Products
Added: 2025-09-04
Due Date: 2025-09-25
Description:
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-50224
Vendor: TP-Link
Product: TL-WR841N
Added: 2025-09-03
Due Date: 2025-09-24
Description:
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-9377
Vendor: TP-Link
Product: Multiple Routers
Added: 2025-09-03
Due Date: 2025-09-24
Description:
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2020-24363
Vendor: TP-Link
Product: TL-WA855RE
Added: 2025-09-02
Due Date: 2025-09-23
Description:
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-55177
Vendor: Meta Platforms
Product: WhatsApp
Added: 2025-09-02
Due Date: 2025-09-23
Description:
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-57819
Vendor: Sangoma
Product: FreePBX
Added: 2025-08-29
Due Date: 2025-09-19
Description:
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-7775
Vendor: Citrix
Product: NetScaler
Added: 2025-08-26
Due Date: 2025-08-28
Description:
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-48384
Vendor: Git
Product: Git
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-8068
Vendor: Citrix
Product: Session Recording
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-8069
Vendor: Citrix
Product: Session Recording
Added: 2025-08-25
Due Date: 2025-09-15
Description:
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-43300
Vendor: Apple
Product: iOS, iPadOS, and macOS
Added: 2025-08-21
Due Date: 2025-09-11
Description:
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs: