{"as_of":"2026-09-11T02:41:11.398Z","catalog_version":"2026.09.10","catalog_released":"2026-09-10T19:00:05.1949Z","catalog_size":1705,"matched":1705,"count":25,"entries":[{"cve_id":"CVE-2026-86060","vendor":"MikroTik","product":"RouterOS","vulnerability_name":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","date_added":"2026-09-10","due_date":"2026-09-13","days_since_added":1,"days_until_due":2,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-88"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-86060"},{"cve_id":"CVE-2026-67277","vendor":"MikroTik","product":"RouterOS","vulnerability_name":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","date_added":"2026-09-10","due_date":"2026-09-13","days_since_added":1,"days_until_due":2,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-67277"},{"cve_id":"CVE-2026-19490","vendor":"Citrix","product":"NetScaler","vulnerability_name":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_added":"2026-09-09","due_date":"2026-09-12","days_since_added":2,"days_until_due":1,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-288"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-19490"},{"cve_id":"CVE-2025-25249","vendor":"Fortinet","product":"Multiple Products","vulnerability_name":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","date_added":"2026-09-09","due_date":"2026-09-12","days_since_added":2,"days_until_due":1,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-122","CWE-787"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-25249"},{"cve_id":"CVE-2026-87491","vendor":"Google","product":"Chromium V8","vulnerability_name":"Google Chromium V8 Out of Bounds Write Vulnerability","date_added":"2026-09-09","due_date":"2026-09-23","days_since_added":2,"days_until_due":12,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-787"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-87491"},{"cve_id":"CVE-2026-20079","vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","vulnerability_name":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_added":"2026-09-09","due_date":"2026-09-12","days_since_added":2,"days_until_due":1,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-288"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-20079"},{"cve_id":"CVE-2026-75650","vendor":"Adobe","product":"Commerce and Magento","vulnerability_name":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_added":"2026-09-08","due_date":"2026-09-11","days_since_added":3,"days_until_due":0,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-1336"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-75650"},{"cve_id":"CVE-2026-81963","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Link Following Vulnerability","date_added":"2026-09-08","due_date":"2026-09-22","days_since_added":3,"days_until_due":11,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-59","CWE-284"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81963"},{"cve_id":"CVE-2026-86218","vendor":"N-able","product":"N-central","vulnerability_name":"N-able N-central Static Code Injection Vulnerability","date_added":"2026-09-08","due_date":"2026-09-11","days_since_added":3,"days_until_due":0,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-96"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-86218"},{"cve_id":"CVE-2026-85880","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","date_added":"2026-09-08","due_date":"2026-09-22","days_since_added":3,"days_until_due":11,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-122","CWE-908"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-85880"},{"cve_id":"CVE-2026-85046","vendor":"Google","product":"Chromium V8","vulnerability_name":"Google Chromium V8 Type Confusion Vulnerability","date_added":"2026-09-04","due_date":"2026-09-18","days_since_added":7,"days_until_due":7,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-843"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-85046"},{"cve_id":"CVE-2026-59822","vendor":"BerriAI","product":"LiteLLM","vulnerability_name":"BerriAI LiteLLM Improper Authentication Vulnerability","date_added":"2026-09-02","due_date":"2026-09-16","days_since_added":9,"days_until_due":5,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-287","CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-59822"},{"cve_id":"CVE-2026-48710","vendor":"Kludex","product":"Starlette","vulnerability_name":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","date_added":"2026-09-02","due_date":"2026-09-16","days_since_added":9,"days_until_due":5,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-444"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"cve_id":"CVE-2026-49869","vendor":"Kestra","product":"Kestra OSS","vulnerability_name":"Kestra OSS OS Command Injection Vulnerability","date_added":"2026-09-02","due_date":"2026-09-05","days_since_added":9,"days_until_due":-6,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-78","CWE-184","CWE-287","CWE-918"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-49869"},{"cve_id":"CVE-2026-82329","vendor":"JFrog","product":"Artifactory","vulnerability_name":"JFrog Artifactory Improper Authentication Vulnerability","date_added":"2026-09-02","due_date":"2026-09-05","days_since_added":9,"days_until_due":-6,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-287"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-82329"},{"cve_id":"CVE-2026-9586","vendor":"Sangoma","product":"Switchvox","vulnerability_name":"Sangoma Switchvox SQL Injection Vulnerability","date_added":"2026-09-02","due_date":"2026-09-05","days_since_added":9,"days_until_due":-6,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-89"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-9586"},{"cve_id":"CVE-2026-83548","vendor":"SonicWall","product":"SMA1000 Appliances","vulnerability_name":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","date_added":"2026-09-02","due_date":"2026-09-05","days_since_added":9,"days_until_due":-6,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-918","CWE-441"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-83548"},{"cve_id":"CVE-2026-83549","vendor":"SonicWall","product":"SMA1000 Appliances","vulnerability_name":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","date_added":"2026-09-02","due_date":"2026-09-05","days_since_added":9,"days_until_due":-6,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-78"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-83549"},{"cve_id":"CVE-2026-82078","vendor":"PaperCut","product":"NG/MF","vulnerability_name":"PaperCut NG/MF Unsafe Reflection Vulnerability","date_added":"2026-08-31","due_date":"2026-09-14","days_since_added":11,"days_until_due":3,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-470"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-82078"},{"cve_id":"CVE-2026-81578","vendor":"PaperCut","product":"NG/MF","vulnerability_name":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","date_added":"2026-08-31","due_date":"2026-09-14","days_since_added":11,"days_until_due":3,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81578"},{"cve_id":"CVE-2023-49105","vendor":"ownCloud","product":"ownCloud","vulnerability_name":"ownCloud Improper Authentication Vulnerability","date_added":"2026-08-27","due_date":"2026-08-30","days_since_added":15,"days_until_due":-12,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-287"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-49105"},{"cve_id":"CVE-2026-53362","vendor":"Linux","product":"Kernel","vulnerability_name":"Linux Kernel Unspecified Vulnerability","date_added":"2026-08-27","due_date":"2026-08-30","days_since_added":15,"days_until_due":-12,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53362"},{"cve_id":"CVE-2026-66384","vendor":"JFrog","product":"Artifactory","vulnerability_name":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","date_added":"2026-08-27","due_date":"2026-09-10","days_since_added":15,"days_until_due":-1,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-22"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-66384"},{"cve_id":"CVE-2021-23758","vendor":"Ajax.NET Professional","product":"Ajax.NET Professional","vulnerability_name":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","date_added":"2026-08-26","due_date":"2026-09-09","days_since_added":16,"days_until_due":-2,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-23758"},{"cve_id":"CVE-2015-3246","vendor":"Red Hat","product":"Libuser","vulnerability_name":"Red Hat Libuser Race Condition Vulnerability","date_added":"2026-08-26","due_date":"2026-09-09","days_since_added":16,"days_until_due":-2,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2015-3246"}],"note":"Day-counts are computed from the federal remediation deadline CISA sets for agencies; they are a severity/urgency signal for everyone else, not an obligation.","source":"CISA Known Exploited Vulnerabilities catalog","disclaimer":"Source data from CISA (US federal public domain), retrieved at as_of; groupings and day-counts are computed by AnswerPool. CVE description text is authored by the MITRE CVE Program and is deliberately not redistributed here — follow cve_url for it. Not security advice; KEV inclusion means known exploitation, not that you are exposed."}