Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.0Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as explo…EPSS 0.2%Oct 15, 2026
- Critical9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.EPSS 0.9%Oct 13, 2026
- High7.7A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.EPSS 0.7%Oct 13, 2026
- High7.5A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.EPSS 0.7%Oct 13, 2026
- Critical9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generat…EPSS 0.8%Oct 13, 2026
- Medium5.5An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial…EPSS 0.3%Oct 13, 2026
- Medium5.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.EPSS 0.5%Oct 13, 2026
- High8.6Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityKEVEPSS 26.0%Oct 13, 2026
- Critical10.0Ivanti Sentry OS Command Injection VulnerabilityKEVEPSS 99.9%Jun 9, 2026
- High8.8An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.May 22, 2026
- High8.8SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.May 12, 2026
- High7.8Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.May 12, 2026
- Medium6.5An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.May 12, 2026
- High7.2OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.May 12, 2026
- Critical9.6External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files…May 12, 2026
- High7.0A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMMay 12, 2026
- Medium4.4An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log…May 12, 2026
- Critical9.1Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging t…May 7, 2026
- Critical9.8An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.May 7, 2026
- Critical9.1An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered S…May 7, 2026
- High8.8An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.May 7, 2026
- High7.2Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityKEVEPSS 2.5%May 7, 2026
- Medium5.4Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions.Apr 14, 2026
- Medium5.7Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.Apr 14, 2026
- High7.8An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Mar 10, 2026
59 records · page 1 of 3
PreviousNext