New that day
- criticalpatchedexploited SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-12).
- highpatchedexploited Omnissa Workspace ONE Server-Side Request Forgery Omnissa Workspace One UEM Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-23).
- highpatchedexploited Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-23).