CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlines
NEOSEC enrichment — no mirror of the original source
The US Cybersecurity and Infrastructure Security Agency has added 10 vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog since Tuesday, August 25. Of those, five have three-day mitigation deadlines. CVE-2026-60004, CVSS sco
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Murray, Neely, Skoudis.
Linked advisories
- CVE-2015-3246Red Hat Libuser: Race Condition
- CVE-2015-3246Red Hat Libuser — Red Hat Libuser Race Condition Vulnerability
- CVE-2015-5287Red Hat Automatic Bug Reporting Tool — Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- CVE-2015-5287Red Hat Automatic Bug Reporting Tool: Rechteausweitung
- CVE-2019-1068Microsoft SQL Server: Remote Code Execution (RCE)
- CVE-2019-1068Microsoft SQL Server — Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2021-23758Remote Code Execution in AjaxNetProfessional
- CVE-2021-23758Duplicate Advisory: Remote Code Execution in AjaxNetProfessional
- CVE-2021-23758Ajax.NET Professional Ajax.NET Professional — Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
- CVE-2021-23758AjaxPro.2: Deserialisierung nicht vertrauenswürdiger Daten
- CVE-2022-0995Kernel: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2022-0995OSV-Eintrag
- CVE-2022-0995Linux Kernel — Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2023-49105ownCloud: Mehrere Schwachstellen
- CVE-2023-49105ownCloud ownCloud — ownCloud Improper Authentication Vulnerability
- CVE-2023-49105ownCloud: unzureichende Authentifizierung
- CVE-2026-53362ipv6: account for fraggap on the paged allocation path
- CVE-2026-53362Linux Kernel: Heap-basierter Pufferüberlauf
- CVE-2026-53362Linux Kernel: Mehrere Schwachstellen
- CVE-2026-53362Linux Kernel — Linux Kernel Unspecified Vulnerability
- CVE-2026-53362Debian mediawiki: security update
- CVE-2026-53362Debian linux: security update
- CVE-2026-60004Gitea: Schwachstelle ermöglicht Codeausführung
- CVE-2026-60004go code.gitea.io/gitea: Code-Injection
- CVE-2026-60004Gitea Gitea — Gitea Code Injection Vulnerability
- CVE-2026-60004OSV-Eintrag
- CVE-2026-66384JFrog Artifactory — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- CVE-2026-66384JFrog Artifactory: Pfadüberschreitung (Path Traversal)
- CVE-2026-66384JFrog Artifactory: Mehrere Schwachstellen
- CVE-2026-8452Citrix NetScaler ADC and NetScaler Gateway — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-8452NetScaler ADC: Denial of Service
- CVE-2026-8452Citrix Systems NetScaler ADC und Gateway: Mehrere Schwachstellen
Affected vendors and products
- Android :linux Kernel:
- Citrix Citrix NetScaler Application Delivery Controller (ADC)
- Citrix Citrix NetScaler Gateway
- Citrix Systems Netscaler
- Citrix Systems Netscaler Adc
- Citrix Systems Netscaler Gateway
- Debian Linux
- Debian Linux-6.1
- Fedora Project Infrastructure Fedora
- Gitea Gitea
- Go Code.gitea.io/gitea
- Go Gitea.dev
More on Mitigation
Other advisories
- HighCVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- HighCVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- Not ratedosv:CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- CriticalCVE-2026-39797Data443 Risk Mitigation GDPR Framework By Data443: Deserialisierung nicht vertrauenswürdiger Daten
- CriticalCVE-2026-39797Data443 Risk Mitigation GDPR Framework By Data443: Deserialisierung nicht vertrauenswürdiger Daten
- Not ratedosv:CLEANSTART-2026-RX54054As mitigation for CVE-2020-1945 Apache Ant 1
- Not ratedosv:CLEANSTART-2025-TN67221As mitigation for CVE-2020-1945 Apache Ant 1
- HighCVE-2026-86043Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Other news entries
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570NewsMicrosoft Threat Intelligence
- ConnectWise warns of new ScreenConnect flaw without patchNewsBleepingComputer
- PaperCut Releases Emergency Patch for Exploited Zero-DayNewsSecurityWeek
- New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root AccessNewsThe Hacker News
- KEV: Oracle, Zimbra, TrueConfVulnerabilitySANS NewsBites
- Critical GitLab Zero-Click Flaw Poses Mitigation ChallengesNewsDark Reading
- CISA Adds Five CVEs to Known Exploited Vulnerabilities CatalogVulnerabilitySANS NewsBites
ID