CISA KEV: Apache ActiveMQ CVE-2026-34197 - ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Goat Feed · Topic
KEV
CISA KEV adds
CISA KEV: Microsoft Windows CVE-2026-21513 - MSHTML Framework Protection Mechanism Failure Vulnerability
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
CISA KEV: Microsoft Windows CVE-2026-21510 - Windows Shell Protection Mechanism Failure Vulnerability
Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
CISA KEV: Microsoft Windows CVE-2025-60710 - Windows Link Following Vulnerability
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
CISA KEV: Apple iOS and iPadOS CVE-2023-41974 - iOS and iPadOS Use-After-Free Vulnerability
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
CISA KEV: Microsoft Windows CVE-2026-21525 - Windows NULL Pointer Dereference Vulnerability
Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
CISA KEV: Linux Kernel CVE-2018-14634 - Kernel Integer Overflow Vulnerability
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
CISA KEV: Microsoft Windows CVE-2026-20805 - Windows Information Disclosure Vulnerability
Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.
CISA KEV: Microsoft Windows CVE-2023-36424 - Windows Out-of-Bounds Read Vulnerability
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
CISA KEV: Microsoft Windows CVE-2008-0015 - Windows Video ActiveX Control Remote Code Execution Vulnerability
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
CISA KEV: Microsoft Windows CVE-2026-32202 (CVSS 4.3 MEDIUM) - Windows Protection Mechanism Failure Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CISA KEV: Microsoft Windows CVE-2026-21533 - Windows Improper Privilege Management Vulnerability
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
CISA KEV: Microsoft Windows CVE-2026-21519 - Windows Type Confusion Vulnerability
Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
CISA KEV: Cisco Catalyst SD-WAN Manager CVE-2026-20128 - Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
CISA KEV: Linux Kernel CVE-2026-31431 - Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
CISA KEV: Microsoft Windows CVE-2008-4250 - Windows Buffer Overflow Vulnerability
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
CISA KEV: Android Framework CVE-2025-48595 - Framework Integer Overflow Vulnerability
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
CISA KEV: Arista Extensible Operating System CVE-2026-7473 (CVSS 4.0 6.9 MEDIUM) - Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
CISA KEV: Linux Kernel CVE-2022-0492 (CVSS 3.1 7.8 HIGH) - Kernel Improper Authentication Vulnerability
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.