Government ❯ Cybersecurity ❯ CISA

Vulnerability Management

Known Exploited Vulnerabilities Federal Agencies Federal Directives Incident Response Public Safety Federal Civilian Executive Branch Known Exploited Vulnerabilities (KEV) Known Exploited Vulnerabilities Catalog Patch Management Binding Operational Directive 22-01

CISA Lists Critical MLflow Flaw Exploited to Steal Cloud Credentials

The designation requires U.S. federal civilian agencies to secure exposed MLflow instances within two weeks under BOD 26-04.

Qilin Ransomware Exploits Palo Alto GlobalProtect Authentication Bypass

CISA Orders Federal Patch for Actively Exploited Fortinet FortiSandbox Flaws

Zimbra Patches Critical Classic Web Client XSS

CISA Adds Microsoft SharePoint RCE to Known Exploited List and Orders Rapid Federal Patching

CISA Adds Ubiquiti and Lantronix Flaws to Known Exploited Vulnerabilities Catalog

Critical Splunk Enterprise Flaw Is Being Exploited; CISA Orders Federal Fix by Sunday

CISA Orders Immediate Fixes for Actively Exploited LiteSpeed and Joomla Plugin Flaws

CISA Says SolarWinds Serv-U Flaw Is Being Exploited to Crash Servers

CISA Adds Exploited Mirasvit Magento Flaw to KEV After Active RCE Attacks

CISA Flags Two-Year-Old Oracle WebLogic Flaw as Actively Exploited

Active Exploits Hit Drupal SQL Injection Flaw CVE-2026-9082

CISA Orders Rapid Patching of Cisco SD‑WAN Admin‑Bypass Flaw CVE‑2026‑20182

CISA Adds ActiveMQ RCE to KEV With April 30 Patch Deadline

Google Rushes Chrome 146 Update to Fix WebGPU Zero-Day Exploited in the Wild

CISA Adds Actively Exploited Langflow RCE to KEV, Sets April 8 Deadline

CISA Flags SharePoint, Zimbra Flaws as Actively Exploited, Sets Rapid Federal Patching Deadlines

CISA Puts Actively Exploited n8n RCE on KEV, Orders Federal Patching by March 25

CISA Flags SmarterMail RCE as Ransomware Target, Sets Feb. 26 Patch Deadline

CISA Forces Three-Day Patch for Actively Exploited SolarWinds Web Help Desk Flaw