CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 6:50 AM ET)

What this means for you

This week: 3,047 CVEs published, 228 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,047; Show in the list
Critical, last 7 days: 228; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product ivanti:connect_secure. Show all products

27 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2019-11539 Known exploited	High 8.0	In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX b… Assigned by mitre	Apr 25, 2019
CVE-2019-11510 Known exploited	Critical 9.9	In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary… Assigned by mitre	May 8, 2019
CVE-2020-8218 Known exploited	High 7.2	A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. Assigned by hackerone	Jul 30, 2020
CVE-2020-8243 Known exploited	High 7.2	A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Assigned by hackerone	Sep 29, 2020
CVE-2020-8260 Known exploited	High 7.2	A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. Assigned by hackerone	Oct 28, 2020
CVE-2021-22893 Known exploited	Critical 10.0	Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect… Assigned by hackerone	Apr 23, 2021
CVE-2021-22894 Known exploited	High 8.8	A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Assigned by hackerone	May 27, 2021
CVE-2021-22899 Known exploited	High 8.8	A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature Assigned by hackerone	May 27, 2021
CVE-2021-22900 Known exploited	High 7.2	A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archi… Assigned by hackerone	May 27, 2021
CVE-2023-46805 Known exploited	High 8.2	An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks. Assigned by hackerone	Jan 12, 2024

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.