https://vulnogram.org/ Most recent CVEs assigned by Ivanti (ivanti). https://vulnogram.org/seaview/icons/ivanti.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-109412 https://vulnogram.org/CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. Critical Tue, 13 Oct 2026 16:23:41 GMT https://vulnogram.org/CVE-2026-106047 https://vulnogram.org/CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files. High Tue, 13 Oct 2026 16:19:39 GMT https://vulnogram.org/CVE-2026-106043 https://vulnogram.org/CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. High Network Exploitable Tue, 13 Oct 2026 16:17:58 GMT https://vulnogram.org/CVE-2026-106042 https://vulnogram.org/CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credential… Critical Tue, 13 Oct 2026 16:12:00 GMT https://vulnogram.org/CVE-2026-106035 https://vulnogram.org/CVE-2026-106035 An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log. Medium Tue, 13 Oct 2026 16:09:07 GMT https://vulnogram.org/CVE-2026-106034 https://vulnogram.org/CVE-2026-106034 A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system. Medium Tue, 13 Oct 2026 16:04:41 GMT https://vulnogram.org/CVE-2026-104935 https://vulnogram.org/CVE-2026-104935 Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. High Known Exploited Network Exploitable Tue, 13 Oct 2026 15:31:07 GMT https://vulnogram.org/CVE-2026-12647 https://vulnogram.org/CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Critical Tue, 08 Sep 2026 14:43:54 GMT https://vulnogram.org/CVE-2026-12646 https://vulnogram.org/CVE-2026-12646 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Critical Tue, 08 Sep 2026 14:40:43 GMT https://vulnogram.org/CVE-2026-12645 https://vulnogram.org/CVE-2026-12645 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Critical Tue, 08 Sep 2026 14:38:14 GMT https://vulnogram.org/CVE-2026-83527 https://vulnogram.org/CVE-2026-83527 An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access. High Network Exploitable Tue, 08 Sep 2026 14:36:49 GMT https://vulnogram.org/CVE-2026-12648 https://vulnogram.org/CVE-2026-12648 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. High Tue, 08 Sep 2026 14:36:00 GMT https://vulnogram.org/CVE-2026-12650 https://vulnogram.org/CVE-2026-12650 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Critical Tue, 08 Sep 2026 14:33:02 GMT https://vulnogram.org/CVE-2026-12651 https://vulnogram.org/CVE-2026-12651 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. High Tue, 08 Sep 2026 14:26:35 GMT https://vulnogram.org/CVE-2026-12745 https://vulnogram.org/CVE-2026-12745 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. Critical Network Exploitable Tue, 08 Sep 2026 14:22:52 GMT https://vulnogram.org/CVE-2026-12744 https://vulnogram.org/CVE-2026-12744 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. Critical Network Exploitable Tue, 08 Sep 2026 14:20:34 GMT https://vulnogram.org/CVE-2026-18851 https://vulnogram.org/CVE-2026-18851 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin. High Tue, 08 Sep 2026 14:14:19 GMT https://vulnogram.org/CVE-2026-18129 https://vulnogram.org/CVE-2026-18129 Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections. High Network Exploitable Tue, 11 Aug 2026 14:26:36 GMT https://vulnogram.org/CVE-2026-18127 https://vulnogram.org/CVE-2026-18127 External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage. High Tue, 11 Aug 2026 14:23:45 GMT https://vulnogram.org/CVE-2026-18125 https://vulnogram.org/CVE-2026-18125 An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service. High Network Exploitable Tue, 11 Aug 2026 14:18:51 GMT https://vulnogram.org/CVE-2026-14903 https://vulnogram.org/CVE-2026-14903 Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root. High Tue, 14 Jul 2026 14:26:09 GMT https://vulnogram.org/CVE-2026-14902 https://vulnogram.org/CVE-2026-14902 An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs. Medium Network Exploitable Tue, 14 Jul 2026 14:23:14 GMT https://vulnogram.org/CVE-2026-10727 https://vulnogram.org/CVE-2026-10727 An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root High Tue, 09 Jun 2026 14:30:48 GMT https://vulnogram.org/CVE-2026-10523 https://vulnogram.org/CVE-2026-10523 An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access Critical Tue, 09 Jun 2026 14:16:41 GMT https://vulnogram.org/CVE-2026-10520 https://vulnogram.org/CVE-2026-10520 An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution Critical Known Exploited Network Exploitable Tue, 09 Jun 2026 14:10:21 GMT https://vulnogram.org/CVE-2026-9614 https://vulnogram.org/CVE-2026-9614 An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access. High Mon, 01 Jun 2026 17:50:03 GMT https://vulnogram.org/CVE-2026-8992 https://vulnogram.org/CVE-2026-8992 An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code. High Network Exploitable Fri, 22 May 2026 14:24:53 GMT https://vulnogram.org/CVE-2026-8111 https://vulnogram.org/CVE-2026-8111 SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. High Tue, 12 May 2026 14:33:45 GMT https://vulnogram.org/CVE-2026-8110 https://vulnogram.org/CVE-2026-8110 Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges. High Tue, 12 May 2026 14:31:26 GMT https://vulnogram.org/CVE-2026-8109 https://vulnogram.org/CVE-2026-8109 An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials. Medium Tue, 12 May 2026 14:29:10 GMT https://vulnogram.org/CVE-2026-8051 https://vulnogram.org/CVE-2026-8051 OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. High Tue, 12 May 2026 14:24:42 GMT https://vulnogram.org/CVE-2026-7432 https://vulnogram.org/CVE-2026-7432 A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM High Tue, 12 May 2026 14:21:58 GMT https://vulnogram.org/CVE-2026-7431 https://vulnogram.org/CVE-2026-7431 An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section. Medium Tue, 12 May 2026 14:18:56 GMT https://vulnogram.org/CVE-2026-8043 https://vulnogram.org/CVE-2026-8043 External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side att… Critical Tue, 12 May 2026 14:11:30 GMT https://vulnogram.org/CVE-2026-5787 https://vulnogram.org/CVE-2026-5787 An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates. High Network Exploitable Thu, 07 May 2026 15:36:41 GMT https://vulnogram.org/CVE-2026-5788 https://vulnogram.org/CVE-2026-5788 An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. High Network Exploitable Thu, 07 May 2026 15:29:49 GMT https://vulnogram.org/CVE-2026-7821 https://vulnogram.org/CVE-2026-7821 Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about E… High Network Exploitable Thu, 07 May 2026 15:26:44 GMT https://vulnogram.org/CVE-2026-6973 https://vulnogram.org/CVE-2026-6973 An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution. High Known Exploited Thu, 07 May 2026 15:21:24 GMT https://vulnogram.org/CVE-2026-5786 https://vulnogram.org/CVE-2026-5786 An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access. High Thu, 07 May 2026 15:18:54 GMT https://vulnogram.org/CVE-2026-4914 https://vulnogram.org/CVE-2026-4914 Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required. Medium Tue, 14 Apr 2026 14:15:48 GMT https://vulnogram.org/CVE-2026-4913 https://vulnogram.org/CVE-2026-4913 Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled. Medium Tue, 14 Apr 2026 14:10:30 GMT https://vulnogram.org/CVE-2026-3483 https://vulnogram.org/CVE-2026-3483 An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges. High Tue, 10 Mar 2026 14:19:25 GMT https://vulnogram.org/CVE-2026-1603 https://vulnogram.org/CVE-2026-1603 An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. High Known Exploited Network Exploitable Tue, 10 Feb 2026 15:09:35 GMT https://vulnogram.org/CVE-2026-1602 https://vulnogram.org/CVE-2026-1602 SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. Medium Tue, 10 Feb 2026 15:07:27 GMT https://vulnogram.org/CVE-2026-1340 https://vulnogram.org/CVE-2026-1340 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. Critical Known Exploited Network Exploitable Thu, 29 Jan 2026 21:33:11 GMT https://vulnogram.org/CVE-2026-1281 https://vulnogram.org/CVE-2026-1281 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. Critical Known Exploited Network Exploitable Thu, 29 Jan 2026 21:31:17 GMT https://vulnogram.org/CVE-2025-13662 https://vulnogram.org/CVE-2025-13662 Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required. High Tue, 09 Dec 2025 16:05:31 GMT https://vulnogram.org/CVE-2025-13661 https://vulnogram.org/CVE-2025-13661 Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required. High Tue, 09 Dec 2025 16:01:18 GMT https://vulnogram.org/CVE-2025-13659 https://vulnogram.org/CVE-2025-13659 Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User inter… High Network Exploitable Tue, 09 Dec 2025 15:59:18 GMT https://vulnogram.org/CVE-2025-10573 https://vulnogram.org/CVE-2025-10573 Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required. Critical Network Exploitable Tue, 09 Dec 2025 15:55:23 GMT