CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 11:30 AM ET)

What this means for you

This week: 3,266 CVEs published, 265 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,266; Show in the list
Critical, last 7 days: 265; Show in the list
Healthcare-tagged, last 7 days: 10; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product ivanti:endpoint_manager_mobile. Show all products

18 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2023-35078 Known exploited	Critical 10.0	An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Assigned by hackerone	Jul 25, 2023
CVE-2023-35081 Known exploited	High 7.2	A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance. Assigned by hackerone	Aug 3, 2023
CVE-2023-35082 Known exploited	Critical 10.0	An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Assigned by hackerone	Aug 15, 2023
CVE-2025-4427 Known exploited	Medium 5.3	Authentication Bypass Assigned by ivanti	May 13, 2025
CVE-2025-4428 Known exploited	High 7.2	Remote Code Execution Assigned by ivanti	May 13, 2025
CVE-2025-10242	High 7.2	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Assigned by ivanti	Oct 14, 2025
CVE-2025-10243	High 7.2	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Assigned by ivanti	Oct 14, 2025
CVE-2025-10985	High 7.2	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Assigned by ivanti	Oct 14, 2025
CVE-2025-10986	Medium 4.7	Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on… Assigned by ivanti	Oct 14, 2025
CVE-2026-1281 Known exploited	Critical 9.8	A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. Assigned by ivanti	Jan 29, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.