Cisa
12 CVEs across 6 Cisa products. Browse Cisa vulnerabilities, severities, and proof-of-concept exploits.
Cisa products with known CVEs
Cisa CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-43510 | Medium | 5.9 | 2026-05-07 | manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domain… |
CVE-2025-67634 | Medium | 4.4 | 2025-12-12 | The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could c… |
CVE-2025-35436 | Medium | 5.3 | 2025-09-17 | CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by provid… |
CVE-2025-35435 | Medium | 4.3 | 2025-09-17 | CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit… |
CVE-2025-35434 | Medium | 4.2 | 2025-09-17 | CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonat… |
CVE-2025-35433 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log i… |
CVE-2025-35432 | Medium | 5.3 | 2025-09-17 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user… |
CVE-2025-35431 | Medium | 5.4 | 2025-09-17 | CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group me… |
CVE-2025-35430 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker coul… |
CVE-2023-7244 | Critical | 9.8 | 2024-03-01 | Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
write in their… |
CVE-2023-7243 | Critical | 9.8 | 2024-03-01 |
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
write while a… |
CVE-2023-7242 | High | 8.2 | 2024-03-01 |
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
read during… |