CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,267 CVEs published, 265 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,267
Show in the list
Critical, last 7 days
265
Show in the list
Healthcare-tagged, last 7 days
10
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product ivanti:endpoint_manager. Show all products

30 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2024-29824
Known exploited
Critical 9.6An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Assigned by hackerone
May 31, 2024
CVE-2024-13161
Known exploited
Critical 9.8Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Assigned by ivanti
Jan 14, 2025
CVE-2024-13160
Known exploited
Critical 9.8Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Assigned by ivanti
Jan 14, 2025
CVE-2024-13159
Known exploited
Critical 9.8Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Assigned by ivanti
Jan 14, 2025
CVE-2025-11622High 7.8Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
Assigned by ivanti
Oct 13, 2025
CVE-2025-9713High 8.8Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.
Assigned by ivanti
Oct 13, 2025
CVE-2025-11623Medium 6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Assigned by ivanti
Oct 13, 2025
CVE-2025-62392Medium 6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Assigned by ivanti
Oct 13, 2025
CVE-2025-62390Medium 6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Assigned by ivanti
Oct 13, 2025
CVE-2025-62389Medium 6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Assigned by ivanti
Oct 13, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.