Skip to content

Standards

A standard is the rulebook · a baseline picks its rules for a system · a control is one rule Standardsthe rulebooks this instance tracks Baselinesthe set of rules chosen for a platform Controlsone rule at a time, and what changed

STIGsa platform's rules, with check and fix Change registerevery release, control by control Atlasthe rhythm of releases, and what is due

Where it all comes from Learnwhere every rule comes from, and who derived it from whom

Vulnerabilities

Vulnerabilitiesevery CVE, scored and marked: KEV, EPSS, exploits Patch TuesdayMicrosoft's monthly release, by update and product FeedsRSS, OPML and a KEV calendar for your reader

Scan

This browserads, trackers and filtering DNS, seen from this tab A domainmail, DNS and web posture, each record quoted A devicepaste what it runs, see which CVEs apply Your networkthe LAN resolver, from this server, daily Historyevery run, and what changed between them By handthe same checks done yourself, per platform

SearchSearch

1 STIGs

Desk

Your fleet and your work Fleetyour releases and the hardware they run on Triagewhat needs a decision Watchlistthe products and platforms you run Saved searchesthe lists you come back to

This instance Sourceswhat is read, how often, under what terms Digestthe daily or weekly summary, and alerts

How it is drawn Appearancethe look and the colour scheme Brandingthe mark this instance wears

Network devices STIGs

1 STIG followed · All platforms

STIG

All 42 CAT I 8 CAT II 34 CAT III 0 Browse in the Register

Cisco IOS XE Router NDM

Version: Y26M04
Published: 2026-04-07 · loaded 15 Oct
Rules: 42: 8 CAT I, 34 CAT II, 0 CAT III
Source: DISA zip

What changed in Y26M04

First version loaded; the next release will be diffed against it rule by rule.

CISA on Network devices

Known exploited 322

Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-114625 · added 2026-10-23 · due 2026-10-26
Fortinet Multiple Products: Fortinet Multiple Products Path Traversal VulnerabilityCVE-2025-61624 · added 2026-10-16 · due 2026-10-19
Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection VulnerabilityCVE-2026-0322 · added 2026-10-14 · due 2026-10-17
Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · added 2026-10-14 · due 2026-10-17
Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVE-2026-104935 · added 2026-10-13 · due 2026-10-16
Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · added 2026-10-04 · due 2026-10-07
Fortinet FortiMail: Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · added 2026-10-01 · due 2026-10-04
Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504 · added 2026-09-30 · due 2026-10-03
Citrix NetScaler: Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · added 2026-09-27 · due 2026-09-30
Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · added 2026-09-27 · due 2026-09-30
MikroTik RouterOS: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · added 2026-09-25 · due 2026-09-28
Check Point Multiple Products: Check Point Multiple Products Improper Certificate Validation VulnerabilityCVE-2026-85102 · added 2026-09-22 · due 2026-09-25

All KEV additions in the News

Directives 12

BOD 26-04: Prioritizing Security Updates Based on RiskBinding Operational Directive · 2026-06-10 · every platform
BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on RiskBinding Operational Directive · 2026-06-10 · every platform
V1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco DevicesEmergency Directive · 2026-04-23
V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN SystemsEmergency Directive · 2026-03-11
Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN SystemsEmergency Directive · 2026-02-25
ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN SystemsEmergency Directive · 2026-02-25
BOD 26-02: Mitigating Risk From End-of-Support Edge DevicesBinding Operational Directive · 2026-02-05
ED 26-01: Mitigate Vulnerabilities in F5 DevicesEmergency Directive · 2025-10-15
Supplemental Direction ED 25-03: Core Dump and Hunt InstructionsEmergency Directive · 2025-09-25 · every platform
ED 25-03: Identify and Mitigate Potential Compromise of Cisco DevicesEmergency Directive · 2025-09-25
BOD 25-01: Implementation Guidance for Implementing Secure Practices for Cloud ServicesBinding Operational Directive · 2024-12-17 · every platform
BOD 25-01: Implementing Secure Practices for Cloud ServicesBinding Operational Directive · 2024-12-17 · every platform

KEV entries are matched by CISA's vendor and product; directives by what their titles name. Both are CISA's own words, linked.

BaselineWatch 0.54.0 · a change register for the security standards themselves · how to read this site · source · health

This product uses the NVD API but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation. Known Exploited Vulnerabilities Catalog provided by CISA. EPSS scores provided by FIRST. Package advisories from OSV.dev and the GitHub Advisory Database (CC-BY 4.0). CIS and Microsoft content is shown from your own copy under your own licence and is never redistributed. Article images belong to their publishers and link to the original story. AdFection / Candiru indicators are the Zero Breach project's (CC0), which is not affiliated with the researchers it cites. Canary names are quoted from EasyList and EasyPrivacy (GPLv3 or CC BY-SA 3.0) and from URLhaus by abuse.ch; they are only ever resolved, never loaded, and nothing here links to them. A source whose licence restricts display shows its entries to this instance's owner only.