home.social

#cisa_kev — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #cisa_kev, aggregated by home.social.

fetched live
  1. Habr @[email protected] ·

    Никто не показывает, как стандарты ИБ связаны друг с другом поэтому пришлось собрать самому

    OWASP, лаборатории, CVE, инструменты и патчи обычно живут в разных местах. Каждый раз собирать этот маршрут заново утомительно, поэтому и сделал RØØT — автономный полигон, который связывает всё в один процесс: понять → проверить → доказать → исправить → перепроверить

    habr.com/ru/articles/1065380/

    #кибербезопасность #AppSec #OWASP #CTF #API_Security #DevSecOps #CVE #CISA_KEV #open_source #root

    #root #open_source #cisa_kev #cve #devsecops #api_security
  2. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0722] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-16232 (secdb.nttzen.cloud/cve/detail/)
    - Name: Check Point SmartConsole Improper Authentication Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Check Point
    - Product: SmartConsole
    - Notes: support.checkpoint.com/results ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-50522 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: SharePoint
    - Notes: msrc.microsoft.com/update-guid ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260722 #cisa20260722 #cve_2026_16232 #cve_2026_50522 #cve202616232 #cve202650522

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260722
  3. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0714] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-56155 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Active Directory Federation Services
    - Notes: msrc.microsoft.com/update-guid ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-56164 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: SharePoint Server
    - Notes: msrc.microsoft.com/update-guid ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260714 #cisa20260714 #cve_2026_56155 #cve_2026_56164 #cve202656155 #cve202656164

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260714
  4. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0625] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-12569 (secdb.nttzen.cloud/cve/detail/)
    - Name: PTC Windchill and FlexPLM Improper Input Validation Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: PTC
    - Product: Windchill and FlexPLM
    - Notes: ptc.com/en/support/article/CS4 ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-20230 (secdb.nttzen.cloud/cve/detail/)
    - Name: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Cisco
    - Product: Unified Communications Manager
    - Notes: cisco.com/c/en/us/support/docs ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260625 #cisa20260625 #cve_2026_12569 #cve_2026_20230 #cve202612569 #cve202620230

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260625
  5. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0623] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2025-67038 (secdb.nttzen.cloud/cve/detail/)
    - Name: Lantronix EDS5000 Code Injection Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Lantronix
    - Product: EDS5000
    - Notes: ltrxdev.atlassian.net/wiki/spa ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-34908 (secdb.nttzen.cloud/cve/detail/)
    - Name: Ubiquiti UniFi OS Improper Access Control Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Ubiquiti
    - Product: UniFi OS
    - Notes: community.ui.com/releases/Secu ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-34909 (secdb.nttzen.cloud/cve/detail/)
    - Name: Ubiquiti UniFi OS Path Traversal Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Ubiquiti
    - Product: UniFi OS
    - Notes: community.ui.com/releases/Secu ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-34910 (secdb.nttzen.cloud/cve/detail/)
    - Name: Ubiquiti UniFi OS Improper Input Validation Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Ubiquiti
    - Product: UniFi OS
    - Notes: community.ui.com/releases/Secu ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260623 #cisa20260623 #cve_2025_67038 #cve_2026_34908 #cve_2026_34909 #cve_2026_34910 #cve202567038 #cve202634908 #cve202634909 #cve202634910

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260623
  6. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0615] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-20262 (secdb.nttzen.cloud/cve/detail/)
    - Name: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Cisco
    - Product: Catalyst SD-WAN Manager
    - Notes: sec.cloudapps.cisco.com/securi ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-54420 (secdb.nttzen.cloud/cve/detail/)
    - Name: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: LiteSpeed
    - Product: cPanel Plugin
    - Notes: blog.litespeedtech.com/2026/06 ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260615 #cisa20260615 #cve_2026_20262 #cve_2026_54420 #cve202620262 #cve202654420

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260615
  7. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0608] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-42271 (secdb.nttzen.cloud/cve/detail/)
    - Name: BerriAI LiteLLM Command Injection Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: BerriAI
    - Product: LiteLLM
    - Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: github.com/BerriAI/litellm/sec ; github.com/BerriAI/litellm/rel ; nvd.nist.gov/vuln/detail/CVE-2

    #ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260608 #cisa20260608 #cve_2026_42271 #cve202642271

    #zen #secdb #infosec #cve #cisa_kev #cisa_20260608
  8. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0527] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-45321 (secdb.nttzen.cloud/cve/detail/)
    - Name: TanStack Unspecified Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: TanStack
    - Product: TanStack
    - Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: github.com/TanStack/router/sec ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-48027 (secdb.nttzen.cloud/cve/detail/)
    - Name: Nx Console Embedded Malicious Code Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Nx
    - Product: Nx Console
    - Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: github.com/nrwl/nx-console/sec ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-8398 (secdb.nttzen.cloud/cve/detail/)
    - Name: Daemon Tools Lite Embedded Malicious Code Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Daemon
    - Product: Daemon Tools Lite
    - Notes: blog.daemon-tools.cc/post/secu ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260527 #cisa20260527 #cve_2026_45321 #cve_2026_48027 #cve_2026_8398 #cve202645321 #cve202648027 #cve20268398

    #secdb #infosec #cve #cisa_kev #cisa_20260527 #cisa20260527
  9. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2025-34291 (secdb.nttzen.cloud/cve/detail/)
    - Name: Langflow Origin Validation Error Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Langflow
    - Product: Langflow
    - Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: github.com/langflow-ai/langflow ; github.com/langflow-ai/langflo; github.com/langflow-ai/langflo ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-34926 (secdb.nttzen.cloud/cve/detail/)
    - Name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Trend Micro
    - Product: Apex One
    - Notes: success.trendmicro.com/en-US/s ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260521 #cisa20260521 #cve_2025_34291 #cve_2026_34926 #cve202534291 #cve202634926

    #secdb #infosec #cve #cisa_kev #cisa_20260521 #cisa20260521
  10. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2008-4250 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Windows Buffer Overflow Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Windows
    - Notes: learn.microsoft.com/en-us/secu ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2009-1537 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: DirectX
    - Notes: learn.microsoft.com/en-us/secu ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2009-3459 (secdb.nttzen.cloud/cve/detail/)
    - Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Adobe
    - Product: Acrobat and Reader
    - Notes: cisa.gov/news-events/alerts/20 ; web.archive.org/web/2012032417).-,NOTE%3A,-There%20are%20reports ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2010-0249 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Internet Explorer Use-After-Free Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Internet Explorer
    - Notes: learn.microsoft.com/en-us/secu ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2010-0806 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Internet Explorer Use-After-Free Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Internet Explorer
    - Notes: learn.microsoft.com/en-us/secu ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-41091 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Defender Link Following Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Defender
    - Notes: msrc.microsoft.com/update-guid ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-45498 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Defender Denial of Service Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Defender
    - Notes: msrc.microsoft.com/update-guid ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260520 #cisa20260520 #cve_2008_4250 #cve_2009_1537 #cve_2009_3459 #cve_2010_0249 #cve_2010_0806 #cve_2026_41091 #cve_2026_45498 #cve20084250 #cve20091537 #cve20093459 #cve20100249 #cve20100806 #cve202641091 #cve202645498

    #secdb #infosec #cve #cisa_kev #cisa_20260520 #cisa20260520
  11. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0508] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-42208 (secdb.nttzen.cloud/cve/detail/)
    - Name: BerriAI LiteLLM SQL Injection Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: BerriAI
    - Product: LiteLLM
    - Notes: github.com/BerriAI/litellm/sec ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260508 #cisa20260508 #cve_2026_42208 #cve202642208

    #secdb #infosec #cve #cisa_kev #cisa_20260508 #cisa20260508
  12. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0420] CISA Adds 8 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 8 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2023-27351 (secdb.nttzen.cloud/cve/detail/)
    - Name: PaperCut NG/MF Improper Authentication Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: PaperCut
    - Product: NG/MF
    - Notes: papercut.com/kb/Main/PO-1216-a ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2024-27199 (secdb.nttzen.cloud/cve/detail/)
    - Name: JetBrains TeamCity Relative Path Traversal Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: JetBrains
    - Product: TeamCity
    - Notes: jetbrains.com/privacy-security ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2025-2749 (secdb.nttzen.cloud/cve/detail/)
    - Name: Kentico Xperience Path Traversal Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Kentico
    - Product: Kentico Xperience
    - Notes: devnet.kentico.com/download/ho ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2025-32975 (secdb.nttzen.cloud/cve/detail/)
    - Name: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Quest
    - Product: KACE Systems Management Appliance (SMA)
    - Notes: support.quest.com/kb/4379499/q ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2025-48700 (secdb.nttzen.cloud/cve/detail/)
    - Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Synacor
    - Product: Zimbra Collaboration Suite (ZCS)
    - Notes: wiki.zimbra.com/wiki/Zimbra_Se ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-20122 (secdb.nttzen.cloud/cve/detail/)
    - Name: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
    - Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Cisco
    - Product: Catalyst SD-WAN Manger
    - Notes: CISA Mitigation Instructions: cisa.gov/news-events/directive ; cisa.gov/news-events/directive ; sec.cloudapps.cisco.com/securi ; nvd.nist.gov/vuln/detail/ CVE-2026-20122

    ⚠️ CVE-2026-20128 (secdb.nttzen.cloud/cve/detail/)
    - Name: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
    - Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Cisco
    - Product: Catalyst SD-WAN Manager
    - Notes: CISA Mitigation Instructions: cisa.gov/news-events/directive ; cisa.gov/news-events/directive ; sec.cloudapps.cisco.com/securi ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-20133 (secdb.nttzen.cloud/cve/detail/)
    - Name: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
    - Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Cisco
    - Product: Catalyst SD-WAN Manager
    - Notes: CISA Mitigation Instructions: cisa.gov/news-events/directive ; cisa.gov/news-events/directive ; sec.cloudapps.cisco.com/securi ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260420 #cisa20260420 #cve_2023_27351 #cve_2024_27199 #cve_2025_2749 #cve_2025_32975 #cve_2025_48700 #cve_2026_20122 #cve_2026_20128 #cve_2026_20133 #cve202327351 #cve202427199 #cve20252749 #cve202532975 #cve202548700 #cve202620122 #cve202620128 #cve202620133

    #secdb #infosec #cve #cisa_kev #cisa_20260420 #cisa20260420
  13. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2012-1854 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Visual Basic for Applications (VBA)
    - Notes: learn.microsoft.com/en-us/secu ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2020-9715 (secdb.nttzen.cloud/cve/detail/)
    - Name: Adobe Acrobat Use-After-Free Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Adobe
    - Product: Acrobat
    - Notes: helpx.adobe.com/security/produ ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2023-21529 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Exchange Server
    - Notes: msrc.microsoft.com/update-guid ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2023-36424 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Windows Out-of-Bounds Read Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Windows
    - Notes: msrc.microsoft.com/update-guid ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2025-60710 (secdb.nttzen.cloud/cve/detail/)
    - Name: Microsoft Windows Link Following Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Microsoft
    - Product: Windows
    - Notes: msrc.microsoft.com/update-guid ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-21643 (secdb.nttzen.cloud/cve/detail/)
    - Name: Fortinet SQL Injection Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Fortinet
    - Product: FortiClient EMS
    - Notes: fortiguard.fortinet.com/psirt/ ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-34621 (secdb.nttzen.cloud/cve/detail/)
    - Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Adobe
    - Product: Acrobat and Reader
    - Notes: helpx.adobe.com/security/produ ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

    #secdb #infosec #cve #cisa_kev #cisa_20260413 #cisa20260413
  14. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0327] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2025-53521 (secdb.nttzen.cloud/cve/detail/)
    - Name: F5 BIG-IP Unspecified Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: F5
    - Product: BIG-IP
    - Notes: Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: my.f5.com/manage/s/article/K00 ; my.f5.com/manage/s/article/K00 ; my.f5.com/manage/s/article/K11 ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260327 #cisa20260327 #cve_2025_53521 #cve202553521

    #secdb #infosec #cve #cisa_kev #cisa_20260327 #cisa20260327
  15. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0326] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-33634 (secdb.nttzen.cloud/cve/detail/)
    - Name: Aquasecurity Trivy Embedded Malicious Code Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Aquasecurity
    - Product: Trivy
    - Notes: This vulnerability involves a supply‑chain compromise in a product that may be used across multiple products and environments. Additional vendor‑provided guidance must be followed to ensure full remediation. For more information, please see: github.com/advisories/GHSA-69f ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260326 #cisa20260326 #cve_2026_33634 #cve202633634

    #secdb #infosec #cve #cisa_kev #cisa_20260326 #cisa20260326
  16. ZEN SecDB @[email protected] ·

    🚨 [CISA-2026:0218] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2021-22175 (secdb.nttzen.cloud/cve/detail/)
    - Name: GitLab Server-Side Request Forgery (SSRF) Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: GitLab
    - Product: GitLab
    - Notes: gitlab.com/gitlab-org/cves/-/b ; nvd.nist.gov/vuln/detail/CVE-2

    ⚠️ CVE-2026-22769 (secdb.nttzen.cloud/cve/detail/)
    - Name: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Dell
    - Product: RecoverPoint for Virtual Machines (RP4VMs)
    - Notes: dell.com/support/kbdoc/en-us/0 ; dell.com/support/kbdoc/en-us/0 ; cloud.google.com/blog/topics/t ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260218 #cisa20260218 #cve_2021_22175 #cve_2026_22769 #cve202122175 #cve202622769

    #secdb #infosec #cve #cisa_kev #cisa_20260218 #cisa20260218
  17. ZEN SecDB @[email protected] ·

    🚨 [CISA-2025:1110] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2025-21042 (secdb.nttzen.cloud/cve/detail/)
    - Name: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Samsung
    - Product: Mobile Devices
    - Notes: security.samsungmobile.com/sec ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CVE #CISA_KEV #cisa_20251110 #cisa20251110 #cve_2025_21042 #cve202521042

    #secdb #infosec #cve #cisa_kev #cisa_20251110 #cisa20251110
  18. ZEN SecDB @[email protected] ·

    [CISA-2025:0923] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    CVE-2025-10585 (secdb.nttzen.cloud/cve/detail/)
    - Name: Google Chromium V8 Type Confusion Vulnerability
    - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Google
    - Product: Chromium V8
    - Notes: chromereleases.googleblog.com/ ; nvd.nist.gov/vuln/detail/CVE-2

    #SecDB #InfoSec #CISA_KEV #cisa_20250923 #cve_2025_10585

    #secdb #infosec #cisa_kev #cisa_20250923 #cve_2025_10585