[?] Related tags:
Two concurrent multipart requests to an unauthenticated Struts action hand an attacker Jetty's live configuration, and from there a root-adjacent shell on the box that manages every endpoint an MSP touches. CVSS 10.0, exploited before disclosure, in CISA KEV on September 8 -- the fourth N-central hotfix in five weeks.
A default-configuration authentication weakness in JFrog Artifactory lets an unauthenticated attacker mint administrator tokens. Patched on August 28, exploited in the wild by September 1, in CISA KEV by September 2 -- and the box it compromises is the one your entire build pipeline trusts.
Citrix shipped the fix on June 30 and called it a denial of service. Seven weeks later watchTowr turned the same heap overflow into pre-auth root, and web shells landed on unpatched NetScaler appliances within days -- CISA added it to KEV on August 26 with a three-day deadline.
Four separate failures in SharePoint's JWT validation pipeline let an unauthenticated attacker forge a token for any user -- including a site administrator -- and CISA added it to the KEV catalog on August 18 after exploitation followed the public PoC within a day.
A deserialization flaw in Microsoft SharePoint Server lets an authenticated low-privilege user run code on the server -- now added to the CISA KEV catalog under confirmed active exploitation
A missing-authentication flaw in Splunk Enterprise's PostgreSQL sidecar service lets unauthenticated attackers create and overwrite arbitrary files -- chained into remote code execution, actively exploited in the wild, and the first Splunk bug ever added to CISA KEV
An unauthenticated SQL injection in Drupal core's PostgreSQL EntityQuery handler -- anonymous attackers turn JSON object keys and JSON:API filter parameters into raw SQL fragments. Drupal-rated 23/25 'Highly Critical', CISA KEV, 15,000+ exploit attempts in 48 hours
A buffer overflow in the PAN-OS User-ID Authentication Portal lets a remote, unauthenticated attacker pop a root shell on PA-Series and VM-Series firewalls -- CVSS 9.3, CISA KEV, actively exploited by a likely state-sponsored cluster (CL-STA-1132)
A nine-year-old logic bug in the Linux kernel's algif_aead crypto module lets any local user write 4 bytes into the page cache of any readable file -- root, container escape, no race condition, public PoC
root@sekurity:~# echo "End of results for tag: CISA KEV"
End of results for tag: CISA KEV
root@sekurity:~# _