This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2025-53521
Vendor: F5
Product: BIG-IP
Added: 2026-03-27
Due Date: 2026-03-30
Description:
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-33634
Vendor: Aquasecurity
Product: Trivy
Added: 2026-03-26
Due Date: 2026-04-09
Description:
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-33017
Vendor: Langflow
Product: Langflow
Added: 2026-03-25
Due Date: 2026-04-08
Description:
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-32432
Vendor: Craft CMS
Product: Craft CMS
Added: 2026-03-20
Due Date: 2026-04-03
Description:
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-54068
Vendor: Laravel
Product: Livewire
Added: 2026-03-20
Due Date: 2026-04-03
Description:
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-43510
Vendor: Apple
Product: Multiple Products
Added: 2026-03-20
Due Date: 2026-04-03
Description:
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-43520
Vendor: Apple
Product: Multiple Products
Added: 2026-03-20
Due Date: 2026-04-03
Description:
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-31277
Vendor: Apple
Product: Multiple Products
Added: 2026-03-20
Due Date: 2026-04-03
Description:
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-20131
Vendor: Cisco
Product: Secure Firewall Management Center (FMC)
Added: 2026-03-19
Due Date: 2026-03-22
Description:
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-66376
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2026-03-18
Due Date: 2026-04-01
Description:
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-20963
Vendor: Microsoft
Product: SharePoint
Added: 2026-03-18
Due Date: 2026-03-21
Description:
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-47813
Vendor: Wing FTP Server
Product: Wing FTP Server
Added: 2026-03-16
Due Date: 2026-03-30
Description:
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-3910
Vendor: Google
Product: Chromium V8
Added: 2026-03-13
Due Date: 2026-03-27
Description:
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2026-3909
Vendor: Google
Product: Skia
Added: 2026-03-13
Due Date: 2026-03-27
Description:
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-68613
Vendor: n8n
Product: n8n
Added: 2026-03-11
Due Date: 2026-03-25
Description:
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs: