IV
Vendor
Ivanti
688
CVEs
85
On KEV
8
New 30D
Products
CS10.0
Connect Secure
VPN
132 CVEs15 on KEV2 new
XT9.9
Xtraction
ivanti
8 CVEs0 on KEV5 new
NP9.9
Neurons Patch for Intune
Ivanti
1 CVEs0 on KEV1 new
PS9.8
Policy Secure
Ivanti
77 CVEs8 on KEV0 new
EM9.8
Endpoint Manager Mobile
Mobile
32 CVEs8 on KEV0 new
EM9.8
Endpoint Manager Mobile (EPMM)
Ivanti
7 CVEs7 on KEV0 new
EM9.9
Endpoint Manager
ivanti
119 CVEs5 on KEV0 new
EM9.8
Endpoint Manager Cloud Services Appliance
Ivanti
6 CVEs5 on KEV0 new
EM8.8
Endpoint Manager (EPM)
Ivanti
5 CVEs5 on KEV0 new
CC9.1
CSA (Cloud Services Appliance)
Ivanti
4 CVEs4 on KEV0 new
CS9.1
Cloud Services Appliance (CSA)
Ivanti
3 CVEs3 on KEV0 new
IP9.1
IPS
Ivanti
3 CVEs3 on KEV0 new
NF9.0
Neurons For Zero-trust Access
Ivanti
5 CVEs2 on KEV0 new
SE10.0
Sentry
ivanti
4 CVEs2 on KEV0 new
NF9.8
Neurons for ZTA gateways
Ivanti
3 CVEs2 on KEV0 new
CS9.1
Connect Secure and Policy Secure
Ivanti
2 CVEs2 on KEV0 new
CS9.8
Connect Secure, Policy Secure, and ZTA Gateways
Ivanti
2 CVEs2 on KEV0 new
ZT9.8
Zero Trust Access Gateway
Ivanti
17 CVEs1 on KEV0 new
CS9.8
Cloud Services Appliance
Ivanti
7 CVEs1 on KEV0 new
SS10.0
Standalone Sentry
Ivanti
4 CVEs1 on KEV0 new
VT9.8
Virtual Traffic Manager
ivanti
2 CVEs1 on KEV0 new
CS8.2
Connect Secure, Policy Secure, and Neurons
Ivanti
1 CVEs1 on KEV0 new
EM9.8
Endpoint Manager Cloud Service Appliance (EPM CSA)
Ivanti
1 CVEs1 on KEV0 new
EM9.8
Endpoint Manager Mobile (EPMM) and MobileIron Core
Ivanti
1 CVEs1 on KEV0 new
EP8.8
EPM
Ivanti
1 CVEs1 on KEV0 new
MM9.8
MobileIron Multiple Products
Ivanti
1 CVEs1 on KEV0 new
MS9.8
MobileIron Sentry
Ivanti
1 CVEs1 on KEV0 new
PC7.2
Pulse Connect Secure and Pulse Policy Secure
Ivanti
1 CVEs1 on KEV0 new
VT9.8
vTM
Ivanti
1 CVEs1 on KEV0 new
AV9.8
Avalanche
Ivanti
117 CVEs0 on KEV0 new
WC9.8
Workspace Control
Ivanti
22 CVEs0 on KEV0 new
SA8.8
Secure Access Client
ivanti
21 CVEs0 on KEV0 new
NF8.9
Neurons For Secure Access
Ivanti
15 CVEs0 on KEV0 new
NF9.9
Neurons for ITSM
Ivanti
14 CVEs0 on KEV0 new
AU7.8
Automation
Ivanti
7 CVEs0 on KEV0 new
DS9.8
Desktop & Server Management
Ivanti
7 CVEs0 on KEV0 new
LM9.8
Landesk Management Suite
Ivanti
6 CVEs0 on KEV0 new
IC8.8
Incapptic Connect
Ivanti
3 CVEs0 on KEV0 new
IN8.8
Ivanti Neurons for ITSM
Ivanti
3 CVEs0 on KEV0 new
SC7.8
Security Controls
Ivanti
3 CVEs0 on KEV0 new
AC7.8
Application Control
Ivanti
2 CVEs0 on KEV0 new
DO5.5
Docs@work
Ivanti
1 CVEs0 on KEV0 new
DN9.8
Dsm Netinst
Ivanti
1 CVEs0 on KEV0 new
DR7.8
Dsm Remote
Ivanti
1 CVEs0 on KEV0 new
ES7.5
Endpoint Security
Ivanti
1 CVEs0 on KEV0 new
NA7.1
Neurons Agent Platform
Ivanti
1 CVEs0 on KEV0 new
NF8.8
Neurons for ITSM (Cloud)
Ivanti
1 CVEs0 on KEV0 new
NF8.8
Neurons for ITSM (On-Premises)
Ivanti
1 CVEs0 on KEV0 new
NF7.1
Neurons For Patch Management
Ivanti
1 CVEs0 on KEV0 new
PF7.1
Patch For Configuration Manager
Ivanti
1 CVEs0 on KEV0 new
PS7.1
Patch Software Development Kit
Ivanti
1 CVEs0 on KEV0 new
PM7.8
Performance Manager
Ivanti
1 CVEs0 on KEV0 new
PS7.8
Pulse Secure Desktop Client
Ivanti
1 CVEs0 on KEV0 new
PS7.8
Pulse Secure Installer Service
Ivanti
1 CVEs0 on KEV0 new
SM6.1
Service Manager
Ivanti
1 CVEs0 on KEV0 new
SM9.8
Service Manager Heat Remote Control
Ivanti
1 CVEs0 on KEV0 new
VL7.8
Velocity License Server
Ivanti
1 CVEs0 on KEV0 new
VA8.8
Virtual Application Delivery Controller
Ivanti
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111357 | CS Connect Secure Ivanti | 7.0 | Oct 15 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the… |
| CVE-2026-109412 | NP Neurons Patch for Intune Ivanti | 9.9 | Oct 13 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information |
| CVE-2026-106047 | XT Xtraction Ivanti | 7.7 | Oct 13 | A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files |
| CVE-2026-106043 | XT Xtraction Ivanti | 7.5 | Oct 13 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site |
| CVE-2026-106042 | XT Xtraction Ivanti | 9.9 | Oct 13 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests… |
| CVE-2026-106035 | XT Xtraction Ivanti | 5.5 | Oct 13 | An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL… |
| CVE-2026-106034 | XT Xtraction Ivanti | 5.0 | Oct 13 | A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system |
| CVE-2026-104935 In wildKEV | CS Connect Secure Ivanti | 8.6 | Oct 13 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
| CVE-2026-12647 | IN Ivanti Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-12646 | IN Ivanti Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-12645 | IN Ivanti Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-83527 | SE Sentry Ivanti | 8.1 | Sep 8 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access |
| CVE-2026-12648 | NF Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-12650 | NF Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-12651 | NF Neurons for ITSM Ivanti | 8.8 | Sep 8 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server |
| CVE-2026-12745 | NF Neurons for ITSM Ivanti | 9.8 | Sep 8 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server |
| CVE-2026-12744 | NF Neurons for ITSM Ivanti | 9.8 | Sep 8 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server |
| CVE-2026-18851 | EM Endpoint Manager Mobile Ivanti | 8.8 | Sep 8 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges… |
| CVE-2026-18129 | EM Endpoint Manager Ivanti | 8.1 | Aug 11 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak… |
| CVE-2026-18127 | EM Endpoint Manager Ivanti | 7.7 | Aug 11 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket… |
| CVE-2026-18125 | EM Endpoint Manager Ivanti | 7.5 | Aug 11 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service |
| CVE-2026-14903 | XT Xtraction ivanti | 6.5 | Jul 14 | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root |
| CVE-2026-14902 | XT Xtraction ivanti | 6.1 | Jul 14 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs |
| CVE-2026-10727 | EM Endpoint Manager Mobile Ivanti | 7.2 | Jun 9 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root |
| CVE-2026-10523 | SE Sentry ivanti | 9.8 | Jun 9 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary… |
| CVE-2026-10520 In wildKEV | SE Sentry ivanti | 10.0 | Jun 9 | Ivanti Sentry OS Command Injection Vulnerability |
| CVE-2026-9614 | NF Neurons for ITSM (Cloud) Ivanti | 8.8 | Jun 1 | An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access |
| CVE-2026-8992 | SA Secure Access Client ivanti | 8.8 | May 22 | An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code |
| CVE-2026-8111 | EM Endpoint Manager ivanti | 8.8 | May 12 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution |
| CVE-2026-8110 | EM Endpoint Manager ivanti | 7.8 | May 12 | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges |
| CVE-2026-8109 | EM Endpoint Manager ivanti | 6.5 | May 12 | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials |
| CVE-2026-8051 | VT Virtual Traffic Manager ivanti | 7.2 | May 12 | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution |
| CVE-2026-7432 | SA Secure Access Client ivanti | 7.0 | May 12 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM |
| CVE-2026-7431 | SA Secure Access Client ivanti | 4.4 | May 12 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via… |
| CVE-2026-8043 | XT Xtraction ivanti | 9.6 | May 12 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web… |
| CVE-2026-5787 | EM Endpoint Manager Mobile Ivanti | 9.1 | May 7 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts… |
| CVE-2026-5788 | EM Endpoint Manager Mobile Ivanti | 9.8 | May 7 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods |
| CVE-2026-7821 | EM Endpoint Manager Mobile Ivanti | 9.1 | May 7 | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a… |
| CVE-2026-6973 In wildKEV | EM Endpoint Manager Mobile Ivanti | 7.2 | May 7 | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability |
| CVE-2026-5786 | EM Endpoint Manager Mobile Ivanti | 8.8 | May 7 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access |
| CVE-2026-3483 | DS Desktop & Server Management Ivanti | 7.8 | Mar 10 | An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges |
| CVE-2026-1602 | EM Endpoint Manager Ivanti | 6.5 | Feb 10 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2026-1603 In wildKEV | EM Endpoint Manager Ivanti | 7.5 | Feb 10 | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability |
| CVE-2026-1340 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
| CVE-2026-1281 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
| CVE-2025-13662 | EM Endpoint Manager Ivanti | 7.8 | Dec 9 | Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated… |
| CVE-2025-13661 | EM Endpoint Manager Ivanti | 8.0 | Dec 9 | Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory |
| CVE-2025-13659 | EM Endpoint Manager Ivanti | 8.8 | Dec 9 | Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files… |
| CVE-2025-10573 | EM Endpoint Manager Ivanti | 6.1 | Dec 9 | Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator… |
| CVE-2025-10918 | EM Endpoint Manager Ivanti | 7.1 | Nov 11 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk |
| CVE-2025-10986 | EM Endpoint Manager Mobile Ivanti | 5.5 | Oct 14 | Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in… |
| CVE-2025-10985 | EM Endpoint Manager Mobile Ivanti | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… |
| CVE-2025-10243 | EM Endpoint Manager Mobile Ivanti | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… |
| CVE-2025-10242 | EM Endpoint Manager Mobile Ivanti | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… |
| CVE-2025-62392 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2025-62391 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2025-62390 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2025-62389 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2025-62388 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |
| CVE-2025-62387 | EM Endpoint Manager Ivanti | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database |