CISA Known Exploited Vulnerabilities

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Metabase has a critical SQL Injection vulnerability (CVE-2026-72898) that allows unauthenticated remote attackers to inject arbitrary SQL into the application database. Successful exploitation can grant attackers administrator access, enabling them to alter configurations, steal stored database credentials, access connected data, and export sensitive information. This vulnerability has a CVSS score of 10 and is known to be exploited in the wild.

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Er zijn twee kwetsbaarheden verholpen in WordPress Core 6.8.6, 6.9.5 en 7.0.2

CVE-2026-20316 is a vulnerability in Cisco Secure Firewall Management Center (FMC) software where a hard-coded, static password exists for a low-privileged account in the web interface. This allows an unauthenticated remote attacker to log in to the affected system using these credentials and access sensitive data. The vulnerability is rated as medium severity by CVSS but Cisco assigns a high security impact rating due to potential privilege escalation when combined with other vulnerabilities. The attack surface is reduced if the FMC management interface is not exposed to the public internet. Multiple versions of Cisco Secure FMC are affected.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

CVE-2023-4346 is a vulnerability in the KNX Association's KNX Protocol Connection Authorization Option 1, involving an overly restrictive account lockout mechanism. This flaw could allow an attacker to purge all devices that do not have additional security options enabled and set a BCU key to lock the device. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation enables modification of security policies and configurations. Remote exploitation requires internet access to the Management Server IP and a configuration that does not restrict Trusted Clients. Check Point is aware of active exploitation affecting a very small number of customers.