Vulnerabilities
Summary — last 7 days
New vulnerabilities3,333▲ 343 vs. last week
Critical / high1,493▲ 121 vs. last week
New active exploitation (KEV)7▼ 3 vs. last week
Unscored (no CVSS)592▲ 117 vs. last week
64 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | Critical (9.8) | 28% | ⚠ Active exploitation | Cisco Asyncos | 9/14/2026 | 9/15/2026 | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An… | |
| Awaiting Analysis | Medium (5.3) | 0.30% | — | Cisco AsyncosAICisco Secure WEB ApplianceAI | 4/15/2026 | 6/17/2026 | A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass authentication policy requirements. This vulnerability is due to improper validation of user-supplied authentication input in HTTP requests. An… | |
| Deferred | Medium (4) | 0.15% | — | Cisco AsyncosAICisco Secure WEB ApplianceAI | 2/4/2026 | 6/17/2026 | A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. | |
| Analyzed | Critical (10) | 32% | ⚠ Active exploitation | Cisco Asyncos | 12/17/2025 | 6/17/2026 | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient… | |
| Analyzed | Medium (5.3) | 0.39% | — | Cisco Asyncos | 3/4/2025 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to obtain sensitive network information. | |
| Analyzed | Medium (6.7) | 0.19% | — | Cisco Asyncos | 2/5/2025 | 6/17/2026 | A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid… | |
| Analyzed | High (7.2) | 0.86% | — | Cisco Asyncos | 2/5/2025 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator… | |
| Analyzed | Medium (5.3) | 0.44% | — | Cisco Asyncos | 2/5/2025 | 6/17/2026 | The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware… | |
| Analyzed | Medium (4.8) | 0.32% | — | Cisco Asyncos | 2/5/2025 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient… | |
| Analyzed | Medium (6.5) | 0.53% | — | Cisco Asyncos | 11/18/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is being… | |
| Analyzed | High (8.8) | 1.9% | — | Cisco Asyncos | 11/15/2024 | 6/17/2026 | A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient… | |
| Analyzed | Medium (5.4) | 0.28% | — | Cisco Asyncos | 11/6/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability… | |
| Analyzed | High (7.8) | 0.16% | — | Cisco Asyncos | 7/17/2024 | 6/17/2026 | A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by… | |
| Analyzed | High (7.2) | 0.62% | — | Cisco Asyncos | 7/17/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device. This vulnerability is due to insufficient input validation in certain portions of the web-based management interface.… | |
| Analyzed | Medium (6.1) | 0.39% | — | Cisco Asyncos | 5/15/2024 | 6/17/2026 | A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based… | |
| Modified | High (8.4) | 0.35% | — | Cisco Asyncos | 5/15/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit… | |
| Analyzed | Medium (6.1) | 0.32% | — | Cisco Asyncos | 5/15/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input.… | |
| Analyzed | Medium (4.8) | 0.29% | — | Cisco Asyncos | 5/15/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.r This vulnerability is due to insufficient validation of user input. An attacker could exploit this… | |
| Analyzed | Medium (4.8) | 0.29% | — | Cisco AsyncosCisco Secure Email AND WEB Manager Virtual Appliance M100vCisco Secure Email AND WEB Manager Virtual Appliance M300vCisco Secure Email AND WEB Manager Virtual Appliance M600v | 5/15/2024 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An… | |
| Modified | Medium (5.3) | 0.63% | — | Cisco Asyncos | 8/4/2023 | 6/17/2026 | A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected zip files. An… | |
| Modified | Medium (5.3) | 0.62% | — | Cisco Asyncos | 8/3/2023 | 6/17/2026 | A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious traffic when the… | |
| Modified | Medium (5.3) | 0.68% | — | Cisco Asyncos | 3/1/2023 | 6/17/2026 | A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked. This vulnerability… | |
| Modified | Medium (5.3) | 0.68% | — | Cisco Asyncos | 1/20/2023 | 6/17/2026 | A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this… | |
| Modified | Medium (6.5) | 0.95% | — | Cisco Asyncos | 11/4/2022 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected… | |
| Modified | High (8.8) | 0.74% | — | Cisco Asyncos | 11/4/2022 | 6/17/2026 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. This… |