CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22893 RansomwareIn wildKEV | 10.0 | Apr 23 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability Affected: PCS 9.0R3 or above, PCS 9.1R1 and above |
| CVE-2019-11510 RansomwareIn wildKEV | 10.0 | May 8 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability Affected: 8.2; 8.2; 8.2; 8.2; 8.2; 8.2; +31 more |
| CVE-2025-22457 RansomwareIn wildKEV | 9.8 | Apr 3 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-21887 RansomwareIn wildKEV | 9.1 | Jan 12 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Affected: 9.1R18 through 9.1R18; 22.6R2 through 22.6R2 |
| CVE-2025-0282 RansomwareIn wildKEV | 9.0 | Jan 8 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: 22.7R2 through 22.7R2.4 |
| CVE-2016-4787 | 10.0 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in… Affected: 8.0; 8.2; 8.1 |
| CVE-2024-21894 | 9.8 | Apr 4 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2018-20813 | 9.8 | Jun 28 | An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 Affected: 8.3 |
| CVE-2018-20810 | 9.8 | Jun 28 | Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure… Affected: 8.3 |
| CVE-2019-11540 | 9.8 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an… Affected: 8.3 |
| CVE-2018-6320 | 9.8 | Sep 6 | A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before… Affected: 8.1 |
| CVE-2024-39712 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-39711 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-39710 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-38656 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
Showing 15