{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T19:10:46.198Z", "tag": { "id": "auth-bypass", "label": "Auth bypass", "isStack": false, "url": "https://pwn.watch/t/auth-bypass", "feed": "https://pwn.watch/t/auth-bypass/feed.xml" }, "counts": { "incidents": 63, "live": 0, "notFullyPatched": 0, "patched": 62 }, "incidents": [ { "slug": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706", "title": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706", "json": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "GitLab Community Edition and Enterprise Edition", "tags": [ "devtools", "gitlab", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-85706" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-11", "closedAt": "2026-09-11", "updatedAt": "2026-09-11", "summary": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.", "xPost": null }, { "slug": "cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew", "title": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using", "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew", "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management", "tags": [ "cisco", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-20079" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-09", "closedAt": "2026-09-09", "updatedAt": "2026-09-09", "summary": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.", "xPost": null }, { "slug": "citrix-netscaler-cve-2026-19490", "title": "Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490", "json": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Citrix NetScaler", "tags": [ "citrix", "netscaler", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-19490" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-09", "closedAt": "2026-09-09", "updatedAt": "2026-09-09", "summary": "Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-59822", "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "mcp", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-59822" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "jfrog-artifactory-cve-2026-82329", "title": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability", "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329", "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "JFrog Artifactory", "tags": [ "devtools", "jfrog", "artifactory", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-82329" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "apple-macos-cve-2026-65400", "title": "Apple macOS: Apple macOS Improper Authentication Vulnerability", "url": "https://pwn.watch/i/apple-macos-cve-2026-65400", "json": "https://pwn.watch/i/apple-macos-cve-2026-65400.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apple macOS", "tags": [ "apple", "macos", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-65400" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "n-able-n-central-cve-2026-18577", "title": "N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "url": "https://pwn.watch/i/n-able-n-central-cve-2026-18577", "json": "https://pwn.watch/i/n-able-n-central-cve-2026-18577.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "N-able N-central", "tags": [ "n-able", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-18577", "CVE-2026-18556" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-03", "closedAt": "2026-08-03", "updatedAt": "2026-08-04", "summary": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. CISA added CVE-2026-18577, CVE-2026-18556 to the Known Exploited Vulnerabilities catalog on 2026-08-03 based on evidence of active exploitation.", "xPost": null }, { "slug": "check-point-smartconsole-cve-2026-16232", "title": "Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability", "url": "https://pwn.watch/i/check-point-smartconsole-cve-2026-16232", "json": "https://pwn.watch/i/check-point-smartconsole-cve-2026-16232.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Check Point SmartConsole", "tags": [ "check-point", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-16232" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-22", "closedAt": "2026-07-22", "updatedAt": "2026-07-22", "summary": "Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Added to CISA KEV on 2026-07-22.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2026-56164", "title": "Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-56164" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-14", "closedAt": "2026-07-14", "updatedAt": "2026-07-14", "summary": "Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14.", "xPost": null }, { "slug": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "title": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "json": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle PeopleSoft Enterprise PeopleTools", "tags": [ "oracle", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-35273" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-12", "closedAt": "2026-06-12", "updatedAt": "2026-06-12", "summary": "Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.", "xPost": null }, { "slug": "check-point-security-gateway-cve-2026-50751", "title": "Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability", "url": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751", "json": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Check Point Security Gateway", "tags": [ "check-point", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-50751" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-06-08", "summary": "Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08.", "xPost": null }, { "slug": "palo-alto-networks-pan-os-cve-2026-0257", "title": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257", "json": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-0257" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-29", "closedAt": "2026-05-29", "updatedAt": "2026-05-29", "summary": "Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Added to CISA KEV on 2026-05-29.", "xPost": null }, { "slug": "cisco-catalyst-sd-wan-cve-2026-20182", "title": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182", "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Catalyst SD-WAN", "tags": [ "cisco", "sd-wan", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-20182" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-14", "closedAt": "2026-05-14", "updatedAt": "2026-05-14", "summary": "Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.", "xPost": null }, { "slug": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "title": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "json": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "WebPros cPanel & WHM and WP2 (WordPress Squared)", "tags": [ "wordpress", "hosting", "cpanel", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-41940" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-30", "closedAt": "2026-04-30", "updatedAt": "2026-04-30", "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.", "xPost": null }, { "slug": "ivanti-endpoint-manager-epm-cve-2026-1603", "title": "Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603", "json": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Endpoint Manager (EPM)", "tags": [ "ivanti", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-1603" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-09", "closedAt": "2026-03-09", "updatedAt": "2026-03-09", "summary": "Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09.", "xPost": null }, { "slug": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127", "title": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127", "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Catalyst SD-WAN Controller and Manager", "tags": [ "cisco", "sd-wan", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-20127" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-25", "closedAt": "2026-02-25", "updatedAt": "2026-02-25", "summary": "Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f", "xPost": null }, { "slug": "smartertools-smartermail-cve-2026-24423", "title": "SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423", "json": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SmarterTools SmarterMail", "tags": [ "smartermail", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-24423" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-05", "closedAt": "2026-02-05", "updatedAt": "2026-02-05", "summary": "SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05.", "xPost": null }, { "slug": "fortinet-multiple-products-cve-2026-24858", "title": "Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability", "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858", "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Fortinet Multiple Products", "tags": [ "fortinet", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-24858" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-27", "closedAt": "2026-01-27", "updatedAt": "2026-01-27", "summary": "Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Added to CISA KEV on 2026-01-27.", "xPost": null }, { "slug": "oracle-fusion-middleware-cve-2025-61757", "title": "Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757", "json": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle Fusion Middleware", "tags": [ "oracle", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-61757" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-21", "closedAt": "2025-11-21", "updatedAt": "2025-11-21", "summary": "Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. Added to CISA KEV on 2025-11-21.", "xPost": null }, { "slug": "kentico-xperience-cms-cve-2025-2746", "title": "Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)", "url": "https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746", "json": "https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Kentico Xperience CMS", "tags": [ "kentico", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-2746", "CVE-2025-2747" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-20", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "CVE-2025-2746: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. CVE-2025-2747: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. Added to CISA KEV on 2025-10-20.", "xPost": null }, { "slug": "skysea-client-view-cve-2016-7836", "title": "SKYSEA Client View: Client View Improper Authentication Vulnerability", "url": "https://pwn.watch/i/skysea-client-view-cve-2016-7836", "json": "https://pwn.watch/i/skysea-client-view-cve-2016-7836.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SKYSEA Client View", "tags": [ "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2016-7836" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-14", "closedAt": "2025-10-14", "updatedAt": "2025-10-14", "summary": "SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Added to CISA KEV on 2025-10-14.", "xPost": null }, { "slug": "juniper-screenos-cve-2015-7755", "title": "Juniper ScreenOS: ScreenOS Improper Authentication Vulnerability", "url": "https://pwn.watch/i/juniper-screenos-cve-2015-7755", "json": "https://pwn.watch/i/juniper-screenos-cve-2015-7755.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Juniper ScreenOS", "tags": [ "juniper", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2015-7755" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-02", "closedAt": "2025-10-02", "updatedAt": "2025-10-02", "summary": "Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device. Added to CISA KEV on 2025-10-02.", "xPost": null }, { "slug": "tp-link-tl-wr841n-cve-2023-50224", "title": "TP-Link TL-WR841N: TL-WR841N Authentication Bypass by Spoofing Vulnerability", "url": "https://pwn.watch/i/tp-link-tl-wr841n-cve-2023-50224", "json": "https://pwn.watch/i/tp-link-tl-wr841n-cve-2023-50224.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "TP-Link TL-WR841N", "tags": [ "tp-link", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-50224" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-03", "closedAt": "2025-09-03", "updatedAt": "2025-09-03", "summary": "TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-09-03.", "xPost": null }, { "slug": "tp-link-tl-wa855re-cve-2020-24363", "title": "TP-Link TL-WA855RE: TL-WA855RE Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/tp-link-tl-wa855re-cve-2020-24363", "json": "https://pwn.watch/i/tp-link-tl-wa855re-cve-2020-24363.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TP-Link TL-WA855RE", "tags": [ "tp-link", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2020-24363" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-02", "closedAt": "2025-09-02", "updatedAt": "2025-09-02", "summary": "TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-09-02.", "xPost": null }, { "slug": "sangoma-freepbx-cve-2025-57819", "title": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819", "json": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sangoma FreePBX", "tags": [ "sangoma", "freepbx", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-57819" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-29", "closedAt": "2025-08-29", "updatedAt": "2025-08-29", "summary": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.", "xPost": null }, { "slug": "ami-megarac-spx-cve-2024-54085", "title": "AMI MegaRAC SPx: MegaRAC SPx Authentication Bypass by Spoofing Vulnerability", "url": "https://pwn.watch/i/ami-megarac-spx-cve-2024-54085", "json": "https://pwn.watch/i/ami-megarac-spx-cve-2024-54085.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "AMI MegaRAC SPx", "tags": [ "ami", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-54085" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-25", "closedAt": "2025-06-25", "updatedAt": "2025-06-25", "summary": "AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Added to CISA KEV on 2025-06-25.", "xPost": null }, { "slug": "asus-routers-cve-2021-32030", "title": "ASUS Routers: Routers Improper Authentication Vulnerability", "url": "https://pwn.watch/i/asus-routers-cve-2021-32030", "json": "https://pwn.watch/i/asus-routers-cve-2021-32030.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "ASUS Routers", "tags": [ "asus", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2021-32030" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-02", "closedAt": "2025-06-02", "updatedAt": "2025-06-02", "summary": "ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-06-02.", "xPost": null }, { "slug": "connectwise-screenconnect-cve-2025-3935", "title": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability", "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935", "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ConnectWise ScreenConnect", "tags": [ "connectwise", "screenconnect", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-3935" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-02", "closedAt": "2025-06-02", "updatedAt": "2025-06-02", "summary": "ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "title": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM)", "tags": [ "ivanti", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-4427", "CVE-2025-4428" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-19", "closedAt": "2025-05-19", "updatedAt": "2025-05-19", "summary": "CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Added to CISA KEV on 2025-05-19.", "xPost": null }, { "slug": "langflow-cve-2025-3248", "title": "Langflow: Missing Authentication Vulnerability", "url": "https://pwn.watch/i/langflow-cve-2025-3248", "json": "https://pwn.watch/i/langflow-cve-2025-3248.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Langflow", "tags": [ "ai", "python", "langflow", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-3248" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-05", "closedAt": "2025-05-05", "updatedAt": "2025-05-05", "summary": "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.", "xPost": null }, { "slug": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "title": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "json": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Erlang/OTP SSH", "tags": [ "erlang", "ssh", "rce", "auth-bypass", "cisa-kev" ], "cveIds": [ "CVE-2025-32433" ], "affectedVersions": [ "OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20" ], "fixedVersions": [ "OTP-27.3.3", "OTP-26.2.5.11", "OTP-25.3.2.20" ], "startedAt": "2025-04-16", "closedAt": "2025-06-09", "updatedAt": "2025-06-09", "summary": "The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.", "xPost": null }, { "slug": "crushftp-cve-2025-31161", "title": "CrushFTP: Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/crushftp-cve-2025-31161", "json": "https://pwn.watch/i/crushftp-cve-2025-31161.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CrushFTP", "tags": [ "crushftp", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-31161" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-07", "closedAt": "2025-04-07", "updatedAt": "2025-04-07", "summary": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.", "xPost": null }, { "slug": "nextjs-middleware-auth-bypass-cve-2025-29927", "title": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927", "json": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Next.js (self-hosted)", "tags": [ "node", "nextjs", "vercel", "auth-bypass" ], "cveIds": [ "CVE-2025-29927" ], "affectedVersions": [ "11.1.4-12.3.4", "13.0.0-13.5.8", "14.0.0-14.2.24", "15.0.0-15.2.2" ], "fixedVersions": [ "12.3.5", "13.5.9", "14.2.25", "15.2.3" ], "startedAt": "2025-03-21", "closedAt": "2025-03-22", "updatedAt": "2025-03-22", "summary": "Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.", "xPost": null }, { "slug": "fortinet-fortios-and-fortiproxy-cve-2025-24472", "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472", "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS and FortiProxy", "tags": [ "fortinet", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-24472" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-18", "closedAt": "2025-03-18", "updatedAt": "2025-03-18", "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Added to CISA KEV on 2025-03-18.", "xPost": null }, { "slug": "sonicwall-sonicos-cve-2024-53704", "title": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability", "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704", "json": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SonicWall SonicOS", "tags": [ "sonicwall", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-53704" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-18", "closedAt": "2025-02-18", "updatedAt": "2025-02-18", "summary": "SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Added to CISA KEV on 2025-02-18.", "xPost": null }, { "slug": "palo-alto-networks-pan-os-cve-2025-0108", "title": "Palo Alto Networks PAN-OS: PAN-OS Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2025-0108", "json": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2025-0108.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-0108" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-18", "closedAt": "2025-02-18", "updatedAt": "2025-02-18", "summary": "Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. Added to CISA KEV on 2025-02-18.", "xPost": null }, { "slug": "fortinet-fortios-and-fortiproxy-cve-2024-55591", "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591", "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS and FortiProxy", "tags": [ "fortinet", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-55591" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-14", "closedAt": "2025-01-14", "updatedAt": "2025-01-14", "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Added to CISA KEV on 2025-01-14.", "xPost": null }, { "slug": "nuuo-nvrmini2-devices-cve-2022-23227", "title": "NUUO NVRmini2 Devices Missing Authentication", "url": "https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227", "json": "https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227.json", "status": "closed", "severity": "critical", "patchStatus": "unpatched", "product": "NUUO NVRmini2 Devices", "tags": [ "nuuo", "nvr", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2022-23227" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "No fix: CISA says the product is end-of-life and should be retired" ], "startedAt": "2024-12-18", "closedAt": "2024-12-18", "updatedAt": "2024-12-18", "summary": "NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Added to the CISA KEV catalog on 2024-12-18. CVE-2022-23227 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "projectsend-cve-2024-11680", "title": "ProjectSend Improper Authentication", "url": "https://pwn.watch/i/projectsend-cve-2024-11680", "json": "https://pwn.watch/i/projectsend-cve-2024-11680.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "ProjectSend", "tags": [ "php", "projectsend", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-11680" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-26", "closedAt": "2024-12-03", "updatedAt": "2024-12-03", "summary": "ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.", "xPost": null }, { "slug": "array-networks-ag-vxag-arrayos-cve-2023-28461", "title": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function", "url": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461", "json": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Array Networks AG/vxAG ArrayOS", "tags": [ "array-networks", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2023-28461" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-25", "closedAt": "2024-11-25", "updatedAt": "2024-11-25", "summary": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. Added to the CISA KEV catalog on 2024-11-25. CISA lists known use in ransomware campaigns. CVE-2023-28461 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "title": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "json": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "auth-bypass", "firewall", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-0012", "CVE-2024-9474" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-18", "closedAt": "2024-11-18", "updatedAt": "2024-11-18", "summary": "CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cyberpersons-cyberpanel-cve-2024-51567-51378", "title": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378", "json": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CyberPersons CyberPanel", "tags": [ "hosting", "cyberpanel", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2024-51567", "CVE-2024-51378" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-29", "closedAt": "2024-12-04", "updatedAt": "2024-12-04", "summary": "CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "fortinet-fortimanager-fortijump-cve-2024-47575", "title": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575", "json": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiManager", "tags": [ "fortinet", "fortimanager", "zero-day", "auth-bypass", "cisa-kev" ], "cveIds": [ "CVE-2024-47575" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-23", "closedAt": "2024-10-23", "updatedAt": "2024-10-23", "summary": "Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.", "xPost": null }, { "slug": "dahua-ip-camera-firmware-cve-2021-33044-33045", "title": "Dahua IP Camera Firmware: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045", "json": "https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Dahua IP Camera Firmware", "tags": [ "dahua", "ip-camera", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2021-33044", "CVE-2021-33045" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-21", "closedAt": "2024-08-21", "updatedAt": "2024-08-21", "summary": "CVE-2021-33044: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. CVE-2021-33045: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-33044, CVE-2021-33045 were assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-virtual-traffic-manager-cve-2024-7593", "title": "Ivanti Virtual Traffic Manager Authentication Bypass", "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593", "json": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Virtual Traffic Manager", "tags": [ "ivanti", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-7593" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-09-24", "updatedAt": "2024-09-24", "summary": "Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.", "xPost": null }, { "slug": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "title": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465", "json": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks Expedition", "tags": [ "palo-alto", "expedition", "cisa-kev", "pan-os", "rce", "sql-injection", "auth-bypass" ], "cveIds": [ "CVE-2024-5910", "CVE-2024-9463", "CVE-2024-9465" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-10", "closedAt": "2024-11-14", "updatedAt": "2024-11-14", "summary": "CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.", "xPost": null }, { "slug": "vmware-esxi-cve-2024-37085", "title": "VMware ESXi Authentication Bypass", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085", "json": "https://pwn.watch/i/vmware-esxi-cve-2024-37085.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "VMware ESXi", "tags": [ "vmware", "esxi", "auth-bypass", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-37085" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-25", "closedAt": "2024-07-30", "updatedAt": "2024-07-30", "summary": "VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "progress-telerik-report-server-cve-2024-4358", "title": "Progress Telerik Report Server Authentication Bypass by Spoofing", "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358", "json": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress Telerik Report Server", "tags": [ "dotnet", "progress", "telerik", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-4358" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-29", "closedAt": "2024-06-13", "updatedAt": "2024-06-13", "summary": "Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.", "xPost": null }, { "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "JetBrains TeamCity", "tags": [ "devtools", "java", "jetbrains", "teamcity", "auth-bypass", "ci-cd", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-27198", "CVE-2024-27199" ], "affectedVersions": [ "TeamCity On-Premises before 2023.11.4 (JetBrains)" ], "fixedVersions": [ "2023.11.4 (JetBrains)" ], "startedAt": "2024-03-04", "closedAt": "2024-03-07", "updatedAt": "2024-03-07", "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "title": "ConnectWise ScreenConnect auth bypass mass-exploited", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709", "json": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "ConnectWise ScreenConnect", "tags": [ "connectwise", "screenconnect", "auth-bypass", "remote-access", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-1709", "CVE-2024-1708" ], "affectedVersions": [ "ScreenConnect 23.9.7 and earlier (ConnectWise bulletin)" ], "fixedVersions": [ "23.9.8 (ConnectWise bulletin)" ], "startedAt": "2024-02-19", "closedAt": "2024-02-22", "updatedAt": "2024-02-22", "summary": "ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "title": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core", "tags": [ "ivanti", "ivanti-epmm", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2023-35082" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-18", "closedAt": "2024-01-18", "updatedAt": "2024-01-18", "summary": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Added to the CISA KEV catalog on 2024-01-18. CISA lists known use in ransomware campaigns. CVE-2023-35082 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "title": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons", "tags": [ "ivanti", "ivanti-connect-secure", "vpn", "zero-day", "auth-bypass", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-46805", "CVE-2024-21887", "CVE-2024-21893" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-31", "updatedAt": "2024-01-31", "summary": "Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "juniper-junos-os-cve-2023-36844-and-4-more", "title": "Juniper Junos OS: 5 exploited vulnerabilities", "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more", "json": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Juniper Junos OS", "tags": [ "juniper", "cisa-kev", "auth-bypass", "junos" ], "cveIds": [ "CVE-2023-36844", "CVE-2023-36845", "CVE-2023-36846", "CVE-2023-36847", "CVE-2023-36851" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-13", "closedAt": "2023-11-13", "updatedAt": "2023-11-13", "summary": "Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Added to CISA KEV on 2023-11-13.", "xPost": null }, { "slug": "atlassian-confluence-improper-authorization-cve-2023-22518", "title": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518", "json": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "auth-bypass", "ransomware", "cerber", "cisa-kev" ], "cveIds": [ "CVE-2023-22518" ], "affectedVersions": [ "All versions of Confluence Data Center and Server before the fixed releases (NVD)" ], "fixedVersions": [ "7.19.16", "8.3.4", "8.4.4", "8.5.3", "8.6.1" ], "startedAt": "2023-10-31", "closedAt": "2023-11-07", "updatedAt": "2023-11-07", "summary": "An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "title": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748", "json": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "F5 BIG-IP Configuration Utility", "tags": [ "f5", "ransomware", "cisa-kev", "sql-injection", "auth-bypass" ], "cveIds": [ "CVE-2023-46747", "CVE-2023-46748" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-31", "closedAt": "2023-10-31", "updatedAt": "2023-10-31", "summary": "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. Added to CISA KEV on 2023-10-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "atlassian-confluence-admin-creation-cve-2023-22515", "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515", "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "zero-day", "auth-bypass", "china", "cisa-kev" ], "cveIds": [ "CVE-2023-22515" ], "affectedVersions": [ "8.0.0 to 8.5.1 (Atlassian advisory)" ], "fixedVersions": [ "8.3.3", "8.4.3", "8.5.2 (LTS)" ], "startedAt": "2023-10-04", "closedAt": "2023-10-16", "updatedAt": "2023-10-16", "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "title": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198", "json": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco IOS XE Software (web UI)", "tags": [ "cisco", "ios-xe", "zero-day", "auth-bypass", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-20198", "CVE-2023-20273" ], "affectedVersions": [ "IOS XE with the HTTP/HTTPS server (web UI) enabled; see vendor advisory" ], "fixedVersions": [ "17.9.4a", "17.6.6a", "17.3.8a", "16.12.10a (Catalyst 3650/3850 only)" ], "startedAt": "2023-09-18", "closedAt": "2023-10-23", "updatedAt": "2023-10-23", "summary": "Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.", "xPost": null }, { "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793", "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "JetBrains TeamCity On-Premises", "tags": [ "devtools", "jetbrains", "teamcity", "ci-cd", "auth-bypass", "rce", "north-korea", "apt29", "cisa-kev" ], "cveIds": [ "CVE-2023-42793" ], "affectedVersions": [ "Before 2023.05.4 (NVD)" ], "fixedVersions": [ "2023.05.4" ], "startedAt": "2023-09-18", "closedAt": "2023-12-13", "updatedAt": "2023-12-13", "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.", "xPost": null }, { "slug": "ivanti-sentry-cve-2023-38035", "title": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)", "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035", "json": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Sentry", "tags": [ "ivanti", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-38035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-08-22", "closedAt": "2023-08-22", "updatedAt": "2023-08-22", "summary": "Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "veeam-backup-replication-cve-2023-27532", "title": "Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532", "json": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Veeam Backup & Replication", "tags": [ "veeam", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-27532" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-08-22", "closedAt": "2023-08-22", "updatedAt": "2023-08-22", "summary": "Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "ivanti-epmm-norway-government-cve-2023-35078", "title": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078", "json": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)", "tags": [ "ivanti", "epmm", "mobileiron", "zero-day", "auth-bypass", "norway", "cisa-kev" ], "cveIds": [ "CVE-2023-35078", "CVE-2023-35081" ], "affectedVersions": [ "CVE-2023-35078: see vendor advisory", "CVE-2023-35081: 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2 (NVD)" ], "fixedVersions": [ "CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD)", "CVE-2023-35078: see vendor advisory" ], "startedAt": "2023-07-24", "closedAt": "2023-08-15", "updatedAt": "2023-08-15", "summary": "APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).", "xPost": null }, { "slug": "vmware-tools-cve-2023-20867", "title": "VMware Tools: Authentication Bypass (CVE-2023-20867)", "url": "https://pwn.watch/i/vmware-tools-cve-2023-20867", "json": "https://pwn.watch/i/vmware-tools-cve-2023-20867.json", "status": "closed", "severity": "low", "patchStatus": "patched", "product": "VMware Tools", "tags": [ "vmware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-20867" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-23", "closedAt": "2023-06-23", "updatedAt": "2023-06-23", "summary": "VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. Added to CISA KEV on 2023-06-23.", "xPost": null }, { "slug": "papercut-mf-ng-auth-bypass-cve-2023-27350", "title": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350", "json": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PaperCut MF and PaperCut NG", "tags": [ "papercut", "auth-bypass", "rce", "cl0p", "lockbit", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-27350" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "20.1.7", "21.2.11", "22.0.9" ], "startedAt": "2023-04-21", "closedAt": "2023-05-11", "updatedAt": "2023-05-11", "summary": "An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.", "xPost": null } ], "posts": [], "changes": [ { "incident": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706", "incidentTitle": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-11", "title": "CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706" }, { "incident": "cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew", "incidentTitle": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-09", "title": "CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew" }, { "incident": "citrix-netscaler-cve-2026-19490", "incidentTitle": "Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-09", "title": "CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490" }, { "incident": "berriai-litellm-cve-2026-59822", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822" }, { "incident": "jfrog-artifactory-cve-2026-82329", "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329" }, { "incident": "apple-macos-cve-2026-65400", "incidentTitle": "Apple macOS: Apple macOS Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-65400 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apple-macos-cve-2026-65400" }, { "incident": "n-able-n-central-cve-2026-18577", "incidentTitle": "N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-03", "title": "CISA added CVE-2026-18577, CVE-2026-18556 to the KEV catalog (due 2026-08-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2026-18577" }, { "incident": "check-point-smartconsole-cve-2026-16232", "incidentTitle": "Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-22", "title": "CISA added CVE-2026-16232 to the KEV catalog (due 2026-07-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/check-point-smartconsole-cve-2026-16232" }, { "incident": "microsoft-sharepoint-server-cve-2026-56164", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-56164 to the KEV catalog (due 2026-07-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164" }, { "incident": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "incidentTitle": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-12", "title": "CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273" }, { "incident": "check-point-security-gateway-cve-2026-50751", "incidentTitle": "Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-50751 to the KEV catalog (due 2026-06-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0257", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-29", "title": "CISA added CVE-2026-0257 to the KEV catalog (due 2026-06-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257" }, { "incident": "cisco-catalyst-sd-wan-cve-2026-20182", "incidentTitle": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-14", "title": "CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182" }, { "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-30", "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940" }, { "incident": "ivanti-endpoint-manager-epm-cve-2026-1603", "incidentTitle": "Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-09", "title": "CISA added CVE-2026-1603 to the KEV catalog (due 2026-03-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603" }, { "incident": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127", "incidentTitle": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-25", "title": "CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127" }, { "incident": "smartertools-smartermail-cve-2026-24423", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423" }, { "incident": "fortinet-multiple-products-cve-2026-24858", "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-27", "title": "CISA added CVE-2026-24858 to the KEV catalog (due 2026-01-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858" }, { "incident": "oracle-fusion-middleware-cve-2025-61757", "incidentTitle": "Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-21", "title": "CISA added CVE-2025-61757 to the KEV catalog (due 2025-12-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757" }, { "incident": "kentico-xperience-cms-cve-2025-2746", "incidentTitle": "Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA added CVE-2025-2746 to the KEV catalog (due 2025-11-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746" }, { "incident": "kentico-xperience-cms-cve-2025-2746", "incidentTitle": "Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA added CVE-2025-2747 to the KEV catalog (due 2025-11-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746" }, { "incident": "skysea-client-view-cve-2016-7836", "incidentTitle": "SKYSEA Client View: Client View Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2016-7836 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/skysea-client-view-cve-2016-7836" }, { "incident": "juniper-screenos-cve-2015-7755", "incidentTitle": "Juniper ScreenOS: ScreenOS Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-02", "title": "CISA added CVE-2015-7755 to the KEV catalog (due 2025-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-screenos-cve-2015-7755" }, { "incident": "tp-link-tl-wr841n-cve-2023-50224", "incidentTitle": "TP-Link TL-WR841N: TL-WR841N Authentication Bypass by Spoofing Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-09-03", "title": "CISA added CVE-2023-50224 to the KEV catalog (due 2025-09-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tp-link-tl-wr841n-cve-2023-50224" }, { "incident": "tp-link-tl-wa855re-cve-2020-24363", "incidentTitle": "TP-Link TL-WA855RE: TL-WA855RE Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-09-02", "title": "CISA added CVE-2020-24363 to the KEV catalog (due 2025-09-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tp-link-tl-wa855re-cve-2020-24363" }, { "incident": "sangoma-freepbx-cve-2025-57819", "incidentTitle": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-29", "title": "CISA added CVE-2025-57819 to the KEV catalog (due 2025-09-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819" }, { "incident": "ami-megarac-spx-cve-2024-54085", "incidentTitle": "AMI MegaRAC SPx: MegaRAC SPx Authentication Bypass by Spoofing Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-25", "title": "CISA added CVE-2024-54085 to the KEV catalog (due 2025-07-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ami-megarac-spx-cve-2024-54085" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-09", "title": "CISA adds CVE-2025-32433 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "asus-routers-cve-2021-32030", "incidentTitle": "ASUS Routers: Routers Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2021-32030 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/asus-routers-cve-2021-32030" }, { "incident": "connectwise-screenconnect-cve-2025-3935", "incidentTitle": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-19", "title": "CISA added CVE-2025-4427 to the KEV catalog (due 2025-06-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-19", "title": "CISA added CVE-2025-4428 to the KEV catalog (due 2025-06-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427" }, { "incident": "langflow-cve-2025-3248", "incidentTitle": "Langflow: Missing Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-05", "title": "CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-cve-2025-3248" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-18", "title": "Discussion and PoC references on oss-security", "body": null, "sourceUrl": "https://openwall.com/lists/oss-security/2025/04/18/2", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-16", "title": "Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases", "body": null, "sourceUrl": "https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "crushftp-cve-2025-31161", "incidentTitle": "CrushFTP: Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-07", "title": "CISA added CVE-2025-31161 to the KEV catalog (due 2025-04-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/crushftp-cve-2025-31161" }, { "incident": "nextjs-middleware-auth-bypass-cve-2025-29927", "incidentTitle": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-22", "title": "Vercel publishes a postmortem on the bypass and its disclosure handling", "body": null, "sourceUrl": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927" }, { "incident": "nextjs-middleware-auth-bypass-cve-2025-29927", "incidentTitle": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-21", "title": "Next.js publishes advisory GHSA-f82v-jwr5-mffw", "body": null, "sourceUrl": "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927" }, { "incident": "fortinet-fortios-and-fortiproxy-cve-2025-24472", "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-18", "title": "CISA added CVE-2025-24472 to the KEV catalog (due 2025-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472" }, { "incident": "sonicwall-sonicos-cve-2024-53704", "incidentTitle": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-18", "title": "CISA added CVE-2024-53704 to the KEV catalog (due 2025-03-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704" }, { "incident": "palo-alto-networks-pan-os-cve-2025-0108", "incidentTitle": "Palo Alto Networks PAN-OS: PAN-OS Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-18", "title": "CISA added CVE-2025-0108 to the KEV catalog (due 2025-03-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2025-0108" }, { "incident": "fortinet-fortios-and-fortiproxy-cve-2024-55591", "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2024-55591 to the KEV catalog (due 2025-01-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591" }, { "incident": "nuuo-nvrmini2-devices-cve-2022-23227", "incidentTitle": "NUUO NVRmini2 Devices Missing Authentication", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-12-18", "title": "CISA added CVE-2022-23227 to the KEV catalog (federal deadline 2025-01-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-04", "title": "CISA added CVE-2024-51378 to the KEV catalog (federal deadline 2024-12-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "projectsend-cve-2024-11680", "incidentTitle": "ProjectSend Improper Authentication", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/projectsend-cve-2024-11680" }, { "incident": "projectsend-cve-2024-11680", "incidentTitle": "ProjectSend Improper Authentication", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-26", "title": "CVE-2024-11680 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11680", "url": "https://pwn.watch/i/projectsend-cve-2024-11680" }, { "incident": "array-networks-ag-vxag-arrayos-cve-2023-28461", "incidentTitle": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-25", "title": "CISA added CVE-2023-28461 to the KEV catalog (federal deadline 2024-12-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-0012 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-9474 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-9474 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-14", "title": "CISA added CVE-2024-9463 to the KEV catalog (federal deadline 2024-12-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-14", "title": "CISA added CVE-2024-9465 to the KEV catalog (federal deadline 2024-12-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2024-51567 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2024-5910 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51567 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51567", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51378 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51378", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "fortinet-fortimanager-fortijump-cve-2024-47575", "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-23", "title": "CVE-2024-47575 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-47575", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575" }, { "incident": "fortinet-fortimanager-fortijump-cve-2024-47575", "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-23", "title": "CISA added CVE-2024-47575 to the KEV catalog (federal deadline 2024-11-13)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CVE-2024-9463 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9463", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CVE-2024-9465 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9465", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "ivanti-virtual-traffic-manager-cve-2024-7593", "incidentTitle": "Ivanti Virtual Traffic Manager Authentication Bypass", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-24", "title": "CISA added CVE-2024-7593 to the KEV catalog (federal deadline 2024-10-15)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593" }, { "incident": "dahua-ip-camera-firmware-cve-2021-33044-33045", "incidentTitle": "Dahua IP Camera Firmware: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-21", "title": "CISA added CVE-2021-33044 to the KEV catalog (federal deadline 2024-09-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045" }, { "incident": "dahua-ip-camera-firmware-cve-2021-33044-33045", "incidentTitle": "Dahua IP Camera Firmware: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-21", "title": "CISA added CVE-2021-33045 to the KEV catalog (federal deadline 2024-09-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045" }, { "incident": "ivanti-virtual-traffic-manager-cve-2024-7593", "incidentTitle": "Ivanti Virtual Traffic Manager Authentication Bypass", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-7593 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-7593", "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-30", "title": "CISA added CVE-2024-37085 to the KEV catalog (federal deadline 2024-08-20)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-10", "title": "CVE-2024-5910 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-5910", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-06-25", "title": "CVE-2024-37085 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-37085", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "progress-telerik-report-server-cve-2024-4358", "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-13", "title": "CISA added CVE-2024-4358 to the KEV catalog (federal deadline 2024-07-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358" }, { "incident": "progress-telerik-report-server-cve-2024-4358", "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-29", "title": "CVE-2024-4358 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4358", "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-07", "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27198 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27199 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses", "body": null, "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-22", "title": "CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-22", "title": "ConnectWise urges on-premise partners to update to 23.9.8 immediately", "body": null, "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-21", "title": "CVE-2024-1709 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1709", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-21", "title": "CVE-2024-1708 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1708", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-19", "title": "Both vulnerabilities reported to ConnectWise; cloud instances remediated", "body": null, "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CVE-2024-21893 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-19", "title": "CISA issues Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-18", "title": "CISA added CVE-2023-35082 to the KEV catalog (federal deadline 2024-02-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2023-46805 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46805", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2024-21887 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21887", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "Volexity discloses active exploitation of two Ivanti Connect Secure zero-days", "body": null, "sourceUrl": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-13", "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "juniper-junos-os-cve-2023-36844-and-4-more", "incidentTitle": "Juniper Junos OS: 5 exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-36844 to the KEV catalog (due 2023-11-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more" }, { "incident": "juniper-junos-os-cve-2023-36844-and-4-more", "incidentTitle": "Juniper Junos OS: 5 exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-36845 to the KEV catalog (due 2023-11-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more" }, { "incident": "juniper-junos-os-cve-2023-36844-and-4-more", "incidentTitle": "Juniper Junos OS: 5 exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-36846 to the KEV catalog (due 2023-11-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more" }, { "incident": "juniper-junos-os-cve-2023-36844-and-4-more", "incidentTitle": "Juniper Junos OS: 5 exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-36847 to the KEV catalog (due 2023-11-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more" }, { "incident": "juniper-junos-os-cve-2023-36844-and-4-more", "incidentTitle": "Juniper Junos OS: 5 exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-36851 to the KEV catalog (due 2023-11-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-07", "title": "CISA adds CVE-2023-22518 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-06", "title": "Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "Atlassian discloses CVE-2023-22518 and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "CISA added CVE-2023-46747 to the KEV catalog (due 2023-11-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748" }, { "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "CISA added CVE-2023-46748 to the KEV catalog (due 2023-11-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-23", "title": "CISA adds CVE-2023-20273 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-22", "title": "First fixed release, 17.9.4a, published", "body": null, "sourceUrl": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-20", "title": "Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "Cisco advisory and Talos write-up on active exploitation; CISA adds CVE-2023-20198 to KEV", "body": null, "sourceUrl": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-05", "title": "CISA adds CVE-2023-22515 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "Atlassian discloses the zero-day after customer reports and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "CISA adds CVE-2023-42793 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Earliest malicious activity found by Cisco Talos", "body": null, "sourceUrl": "https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin", "body": null, "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "ivanti-sentry-cve-2023-38035", "incidentTitle": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-22", "title": "CISA added CVE-2023-38035 to the KEV catalog (due 2023-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035" }, { "incident": "veeam-backup-replication-cve-2023-27532", "incidentTitle": "Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-22", "title": "CISA added CVE-2023-27532 to the KEV catalog (due 2023-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-15", "title": "Norway shuts down the old ministry e-mail solution and rolls out a new one", "body": null, "sourceUrl": "https://www.regjeringen.no/en/whats-new/shutdown-of-e-mail-solution-following-cyberattack/id2991023/", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-01", "title": "CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-28", "title": "Ivanti patches the second bug, CVE-2023-35081", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-25", "title": "CISA adds CVE-2023-35078 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-24", "title": "Norway: cyber-attack on the ICT platform used by 12 ministries through a zero-day in a supplier's software", "body": null, "sourceUrl": "https://www.regjeringen.no/en/whats-new/ministries-hit-by-cyber-attacks/id2990098/", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-23", "title": "Ivanti patches CVE-2023-35078", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "vmware-tools-cve-2023-20867", "incidentTitle": "VMware Tools: Authentication Bypass (CVE-2023-20867)", "severity": "low", "status": "closed", "patchStatus": "patched", "date": "2023-06-23", "title": "CISA added CVE-2023-20867 to the KEV catalog (due 2023-07-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-tools-cve-2023-20867" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-11", "title": "CISA and FBI advisory AA23-131A: Bl00dy Ransomware Gang targeting education via PaperCut", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-04-21", "title": "PaperCut warns that unpatched servers are being exploited in the wild; CISA adds CVE-2023-27350 to KEV", "body": null, "sourceUrl": "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" } ] }