Filtered by vendor Ivanti
Subscribe
Total
505 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-10243 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-10-08 | N/A | 7.2 HIGH |
| OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | |||||
| CVE-2025-10242 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-10-08 | N/A | 7.2 HIGH |
| OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | |||||
| CVE-2025-9713 | 1 Ivanti | 1 Endpoint Manager | 2026-10-08 | N/A | 8.8 HIGH |
| Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. | |||||
| CVE-2025-10985 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-10-08 | N/A | 7.2 HIGH |
| OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | |||||
| CVE-2025-62391 | 1 Ivanti | 1 Endpoint Manager | 2026-10-08 | N/A | 6.5 MEDIUM |
| SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. | |||||
| CVE-2025-13661 | 1 Ivanti | 1 Endpoint Manager | 2026-10-07 | N/A | 7.1 HIGH |
| Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required. | |||||
| CVE-2025-13659 | 1 Ivanti | 1 Endpoint Manager | 2026-10-07 | N/A | 8.8 HIGH |
| Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required. | |||||
| CVE-2025-10573 | 1 Ivanti | 1 Endpoint Manager | 2026-10-07 | N/A | 9.6 CRITICAL |
| Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required. | |||||
| CVE-2025-13662 | 1 Ivanti | 1 Endpoint Manager | 2026-10-07 | N/A | 7.8 HIGH |
| Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required. | |||||
| CVE-2026-10520 | 1 Ivanti | 1 Standalone Sentry | 2026-10-07 | N/A | 10.0 CRITICAL |
| An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution | |||||
| CVE-2023-46805 | 1 Ivanti | 2 Connect Secure, Policy Secure | 2026-10-01 | N/A | 8.2 HIGH |
| An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks. | |||||
| CVE-2025-0282 | 1 Ivanti | 3 Connect Secure, Neurons For Zero-trust Access, Policy Secure | 2026-10-01 | N/A | 9.0 CRITICAL |
| A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. | |||||
| CVE-2024-9379 | 1 Ivanti | 1 Endpoint Manager Cloud Services Appliance | 2026-10-01 | N/A | 6.5 MEDIUM |
| SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. | |||||
| CVE-2025-9872 | 1 Ivanti | 1 Endpoint Manager | 2026-09-26 | N/A | 8.8 HIGH |
| Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. | |||||
| CVE-2026-12645 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 9.9 CRITICAL |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||
| CVE-2026-12646 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 9.9 CRITICAL |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||
| CVE-2026-12647 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 9.9 CRITICAL |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||
| CVE-2026-12650 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 9.9 CRITICAL |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||
| CVE-2026-12648 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 8.8 HIGH |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||
| CVE-2026-12651 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-18 | N/A | 8.8 HIGH |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | |||||