BaselineWatch
58195 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,195 New, 24 h1,450 Changed, 24 h2,512 In KEV127 Public exploit1,566 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-6973KEV 7.2 high 34.0% ivanti, endpoint_manager_mobile An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution. Mon 26 Oct
CVE-2025-61932KEV 9.3 critical 3.0% motex, lanscope_endpoint_manager Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. 8 Oct
CVE-2025-61678exploit 8.6 high 44.0% no CPE yet FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulnerability. Successful exploitation allows authenticated users to upload arbitrary files to attacker-controlled paths on the server, potentially leading to remote code execution. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. 8 Oct
CVE-2025-61675exploit ×3 8.6 high 39.0% no CPE yet FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authenticated users to execute arbitrary SQL queries against the database, potentially enabling access to sensitive data or modification of database contents. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. 8 Oct
CVE-2025-10242 7.2 high 20.0% ivanti, endpoint_manager_mobile OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. 8 Oct
CVE-2025-10243 7.2 high 20.0% ivanti, endpoint_manager_mobile OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. 8 Oct
CVE-2025-10985 7.2 high 20.0% ivanti, endpoint_manager_mobile OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. 8 Oct
CVE-2025-9713 8.8 high 15.0% ivanti, endpoint_manager Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. 8 Oct
CVE-2026-5786 8.8 high 11.0% ivanti, endpoint_manager_mobile An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access. Mon 26 Oct
CVE-2026-8111 8.8 high 6.0% ivanti, endpoint_manager SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. Mon 26 Oct
CVE-2026-18125 7.5 high 2.0% no CPE yet An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service. Fri 23 Oct
CVE-2025-62387 6.5 medium 2.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62389 6.5 medium 2.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62390 6.5 medium 2.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2026-5788 9.8 critical 1.0% ivanti, endpoint_manager_mobile An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. Mon 26 Oct
CVE-2026-7821 9.1 critical 1.0% ivanti, endpoint_manager_mobile Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity. Mon 26 Oct
CVE-2026-5787 9.1 critical 1.0% ivanti, endpoint_manager_mobile An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates. Mon 26 Oct
CVE-2025-59051 8.6 high 1.0% no CPE yet The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue. 8 Oct
CVE-2026-18129 8.1 high 1.0% no CPE yet Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections. Fri 23 Oct
CVE-2025-11622 7.8 high 1.0% ivanti, endpoint_manager Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges. 8 Oct
CVE-2026-18127 7.7 high 1.0% no CPE yet External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage. Fri 23 Oct
CVE-2026-8109 6.5 medium 1.0% ivanti, endpoint_manager An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials. Mon 26 Oct
CVE-2025-11623 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62383 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62384 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62385 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62386 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62388 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62391 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-62392 6.5 medium 1.0% ivanti, endpoint_manager SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. 8 Oct
CVE-2025-10986 5.5 medium 1.0% ivanti, endpoint_manager_mobile Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk. 8 Oct
CVE-2026-18084 8.6 high 0.00% blackberry, unified_endpoint_manager Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSS). This issue affects UEM: 12.23.0 QF8 or earlier. Sat 24 Oct
CVE-2026-8110 7.8 high 0.00% ivanti, endpoint_manager Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges. Mon 26 Oct
CVE-2025-10918 7.1 high 0.00% ivanti, endpoint_manager Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk 18 Oct
CVE-2026-18085 5.9 medium 0.00% blackberry, unified_endpoint_manager An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service. Fri 23 Oct

35 of 35

Download these 35 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.