{"as_of":"2026-10-15T04:47:40.537Z","catalog_version":"2026.10.14","catalog_released":"2026-10-14T19:27:28.0105Z","catalog_size":1745,"matched":361,"count":25,"entries":[{"cve_id":"CVE-2026-59310","vendor":"Broadcom","product":"VMware vCenter","vulnerability_name":"Broadcom VMware vCenter Path Traversal Vulnerability","date_added":"2026-08-18","due_date":"2026-08-21","days_since_added":58,"days_until_due":-55,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-22"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-59310"},{"cve_id":"CVE-2026-63077","vendor":"JetBrains","product":"TeamCity","vulnerability_name":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","date_added":"2026-08-05","due_date":"2026-08-08","days_since_added":71,"days_until_due":-68,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63077"},{"cve_id":"CVE-2026-20316","vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","vulnerability_name":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","date_added":"2026-07-29","due_date":"2026-08-01","days_since_added":78,"days_until_due":-75,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-259"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-20316"},{"cve_id":"CVE-2026-15409","vendor":"SonicWall","product":"SMA1000 Appliances","vulnerability_name":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","date_added":"2026-07-14","due_date":"2026-07-17","days_since_added":93,"days_until_due":-90,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-918"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-15409"},{"cve_id":"CVE-2026-15410","vendor":"SonicWall","product":"SMA1000 Appliances","vulnerability_name":"SonicWall SMA1000 Appliances Code Injection Vulnerability","date_added":"2026-07-14","due_date":"2026-07-17","days_since_added":93,"days_until_due":-90,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-94"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-15410"},{"cve_id":"CVE-2026-45659","vendor":"Microsoft","product":"SharePoint Server","vulnerability_name":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","date_added":"2026-07-01","due_date":"2026-07-04","days_since_added":106,"days_until_due":-103,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45659"},{"cve_id":"CVE-2026-12569","vendor":"PTC","product":"Windchill and FlexPLM","vulnerability_name":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","date_added":"2026-06-25","due_date":"2026-06-28","days_since_added":112,"days_until_due":-109,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-20","CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-12569"},{"cve_id":"CVE-2026-35273","vendor":"Oracle","product":" PeopleSoft Enterprise PeopleTools","vulnerability_name":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","date_added":"2026-06-12","due_date":"2026-06-15","days_since_added":125,"days_until_due":-122,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-35273"},{"cve_id":"CVE-2026-50751","vendor":"Check Point","product":"Security Gateway","vulnerability_name":"Check Point Security Gateway Improper Authentication Vulnerability","date_added":"2026-06-08","due_date":"2026-06-11","days_since_added":129,"days_until_due":-126,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-287"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-50751"},{"cve_id":"CVE-2026-0257","vendor":"Palo Alto Networks","product":"PAN-OS","vulnerability_name":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","date_added":"2026-05-29","due_date":"2026-06-01","days_since_added":139,"days_until_due":-136,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-565"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-0257"},{"cve_id":"CVE-2026-48027","vendor":"Nx","product":"Nx Console","vulnerability_name":"Nx Console Embedded Malicious Code Vulnerability","date_added":"2026-05-27","due_date":"2026-06-10","days_since_added":141,"days_until_due":-127,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-506"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-48027"},{"cve_id":"CVE-2026-45321","vendor":"TanStack","product":"TanStack","vulnerability_name":"TanStack Unspecified Vulnerability","date_added":"2026-05-27","due_date":"2026-06-10","days_since_added":141,"days_until_due":-127,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45321"},{"cve_id":"CVE-2026-41940","vendor":"WebPros","product":"cPanel & WHM and WP2 (WordPress Squared)","vulnerability_name":"WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","date_added":"2026-04-30","due_date":"2026-05-03","days_since_added":168,"days_until_due":-165,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940"},{"cve_id":"CVE-2024-1708","vendor":"ConnectWise","product":"ScreenConnect","vulnerability_name":"ConnectWise ScreenConnect Path Traversal Vulnerability","date_added":"2026-04-28","due_date":"2026-05-12","days_since_added":170,"days_until_due":-156,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-22"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-1708"},{"cve_id":"CVE-2024-57728","vendor":"SimpleHelp ","product":"SimpleHelp","vulnerability_name":"SimpleHelp Path Traversal Vulnerability","date_added":"2026-04-24","due_date":"2026-05-08","days_since_added":174,"days_until_due":-160,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-22"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57728"},{"cve_id":"CVE-2024-57726","vendor":"SimpleHelp ","product":"SimpleHelp","vulnerability_name":"SimpleHelp Missing Authorization Vulnerability","date_added":"2026-04-24","due_date":"2026-05-08","days_since_added":174,"days_until_due":-160,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-862"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57726"},{"cve_id":"CVE-2026-33825","vendor":"Microsoft","product":"Defender","vulnerability_name":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","date_added":"2026-04-22","due_date":"2026-05-06","days_since_added":176,"days_until_due":-162,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-1220"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-33825"},{"cve_id":"CVE-2023-27351","vendor":"PaperCut","product":"NG/MF","vulnerability_name":"PaperCut NG/MF Improper Authentication Vulnerability","date_added":"2026-04-20","due_date":"2026-05-04","days_since_added":178,"days_until_due":-164,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-287"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-27351"},{"cve_id":"CVE-2024-27199","vendor":"JetBrains","product":"TeamCity","vulnerability_name":"JetBrains TeamCity Relative Path Traversal Vulnerability","date_added":"2026-04-20","due_date":"2026-05-04","days_since_added":178,"days_until_due":-164,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-23"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27199"},{"cve_id":"CVE-2025-60710","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Link Following Vulnerability","date_added":"2026-04-13","due_date":"2026-04-27","days_since_added":185,"days_until_due":-171,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-59"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-60710"},{"cve_id":"CVE-2023-21529","vendor":"Microsoft","product":"Exchange Server","vulnerability_name":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability","date_added":"2026-04-13","due_date":"2026-04-27","days_since_added":185,"days_until_due":-171,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-21529"},{"cve_id":"CVE-2026-20131","vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","vulnerability_name":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability","date_added":"2026-03-19","due_date":"2026-03-22","days_since_added":210,"days_until_due":-207,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-20131"},{"cve_id":"CVE-2025-26399","vendor":"SolarWinds","product":"Web Help Desk","vulnerability_name":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","date_added":"2026-03-09","due_date":"2026-03-12","days_since_added":220,"days_until_due":-217,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-26399"},{"cve_id":"CVE-2026-1731","vendor":"BeyondTrust","product":"Remote Support (RS) and Privileged Remote Access (PRA)","vulnerability_name":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability","date_added":"2026-02-13","due_date":"2026-02-16","days_since_added":244,"days_until_due":-241,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-78"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-1731"},{"cve_id":"CVE-2026-24423","vendor":"SmarterTools","product":"SmarterMail","vulnerability_name":"SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability","date_added":"2026-02-05","due_date":"2026-02-26","days_since_added":252,"days_until_due":-231,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-24423"}],"note":"Day-counts are computed from the federal remediation deadline CISA sets for agencies; they are a severity/urgency signal for everyone else, not an obligation.","source":"CISA Known Exploited Vulnerabilities catalog","disclaimer":"Source data from CISA (US federal public domain), retrieved at as_of; groupings and day-counts are computed by AnswerPool. CVE description text is authored by the MITRE CVE Program and is deliberately not redistributed here — follow cve_url for it. Not security advice; KEV inclusion means known exploitation, not that you are exposed.","refresh_after":"2026-10-16T00:00:00.000Z"}