https://exploit-radar.com/en/flux/categories/dev-cicd.xml Exploit Radar: Development and CI/CD The latest additions to CISA’s catalog of exploited vulnerabilities in the “Development and CI/CD” category (indicative classification). 2026-09-11T00:00:00Z Exploit Radar https://exploit-radar.com/en/cve/CVE-2026-85706/ CVE-2026-85706 — GitLab Community / Enterprise Edition (CE/EE) 2026-09-11T00:00:00Z Apply the patches or mitigations from GitLab; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-42016/ CVE-2026-42016 — JFrog Artifactory 2026-09-11T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-42018/ CVE-2026-42018 — JFrog Artifactory 2026-09-11T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-82329/ CVE-2026-82329 — JFrog Artifactory 2026-09-02T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-66384/ CVE-2026-66384 — JFrog Artifactory 2026-08-27T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 27, 2026. https://exploit-radar.com/en/cve/CVE-2026-60004/ CVE-2026-60004 — Gitea 2026-08-25T00:00:00Z Apply the patches or mitigations from Gitea; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2026. https://exploit-radar.com/en/cve/CVE-2026-63077/ CVE-2026-63077 — JetBrains TeamCity 2026-08-05T00:00:00Z Apply the patches or mitigations from JetBrains; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on August 5, 2026. https://exploit-radar.com/en/cve/CVE-2026-48027/ CVE-2026-48027 — Nx Console 2026-05-27T00:00:00Z Apply the patches or mitigations from Nx; if none are available, stop using the product. For cloud services, follow the guidance from Nx. CISA deadline: 14 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 27, 2026. https://exploit-radar.com/en/cve/CVE-2024-27199/ CVE-2024-27199 — JetBrains TeamCity 2026-04-20T00:00:00Z Apply the patches or mitigations from JetBrains; if none are available, stop using the product. For cloud services, follow the guidance from JetBrains. CISA deadline: 14 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on April 20, 2026. https://exploit-radar.com/en/cve/CVE-2026-33634/ CVE-2026-33634 — Aqua Security Trivy 2026-03-26T00:00:00Z Apply the patches or mitigations from Aqua Security; if none are available, stop using the product. For cloud services, follow the guidance from Aqua Security. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on March 26, 2026. https://exploit-radar.com/en/cve/CVE-2021-22175/ CVE-2021-22175 — GitLab Community / Enterprise Edition (CE/EE) 2026-02-18T00:00:00Z Apply the patches or mitigations from GitLab; if none are available, stop using the product. For cloud services, follow the guidance from GitLab. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 18, 2026. https://exploit-radar.com/en/cve/CVE-2025-11953/ CVE-2025-11953 — React Native Community React Native CLI 2026-02-05T00:00:00Z Apply the patches or mitigations from React Native Community; if none are available, stop using the product. For cloud services, follow the guidance from React Native Community. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 5, 2026. https://exploit-radar.com/en/cve/CVE-2021-39935/ CVE-2021-39935 — GitLab Community / Enterprise Edition (CE/EE) 2026-02-03T00:00:00Z Apply the patches or mitigations from GitLab; if none are available, stop using the product. For cloud services, follow the guidance from GitLab. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 3, 2026. https://exploit-radar.com/en/cve/CVE-2025-31125/ CVE-2025-31125 — Vite 2026-01-22T00:00:00Z Apply the patches or mitigations from Vite; if none are available, stop using the product. For cloud services, follow the guidance from Vite. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 22, 2026. https://exploit-radar.com/en/cve/CVE-2025-54313/ CVE-2025-54313 — Prettier eslint-config-prettier 2026-01-22T00:00:00Z Apply the patches or mitigations from Prettier; if none are available, stop using the product. For cloud services, follow the guidance from Prettier. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 22, 2026. https://exploit-radar.com/en/cve/CVE-2025-8110/ CVE-2025-8110 — Gogs 2026-01-12T00:00:00Z Apply the patches or mitigations from Gogs; if none are available, stop using the product. For cloud services, follow the guidance from Gogs. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 12, 2026. https://exploit-radar.com/en/cve/CVE-2017-1000353/ CVE-2017-1000353 — Jenkins Core 2025-10-02T00:00:00Z Apply the patches or mitigations from Jenkins; if none are available, stop using the product. For cloud services, follow the guidance from Jenkins. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 2, 2025. https://exploit-radar.com/en/cve/CVE-2025-48384/ CVE-2025-48384 — Git 2025-08-25T00:00:00Z Apply the patches or mitigations from Git; if none are available, stop using the product. For cloud services, follow the guidance from Git. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2025. https://exploit-radar.com/en/cve/CVE-2025-30154/ CVE-2025-30154 — reviewdog action-setup GitHub Action 2025-03-24T00:00:00Z CISA has issued specific instructions for this vulnerability: read the original text and the NVD entry. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 24, 2025. https://exploit-radar.com/en/cve/CVE-2025-30066/ CVE-2025-30066 — tj-actions changed-files GitHub Action 2025-03-18T00:00:00Z CISA has issued specific instructions for this vulnerability: read the original text and the NVD entry. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 18, 2025. https://exploit-radar.com/en/cve/CVE-2024-23897/ CVE-2024-23897 — Jenkins Core 2024-08-19T00:00:00Z Apply the patches or mitigations from Jenkins; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on August 19, 2024. https://exploit-radar.com/en/cve/CVE-2023-7028/ CVE-2023-7028 — GitLab Community / Enterprise Edition (CE/EE) 2024-05-01T00:00:00Z Apply the patches or mitigations from GitLab; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 1, 2024. https://exploit-radar.com/en/cve/CVE-2024-27198/ CVE-2024-27198 — JetBrains TeamCity 2024-03-07T00:00:00Z Apply the patches or mitigations from JetBrains; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 7, 2024. https://exploit-radar.com/en/cve/CVE-2023-42793/ CVE-2023-42793 — JetBrains TeamCity 2023-10-04T00:00:00Z Apply the patches or mitigations from JetBrains; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on October 4, 2023. https://exploit-radar.com/en/cve/CVE-2015-5317/ CVE-2015-5317 — Jenkins Core 2023-05-12T00:00:00Z Apply the security update from Jenkins. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 12, 2023. https://exploit-radar.com/en/cve/CVE-2022-36804/ CVE-2022-36804 — Atlassian Bitbucket Server / Data Center 2022-09-30T00:00:00Z Apply the security update from Atlassian. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 30, 2022. https://exploit-radar.com/en/cve/CVE-2019-1003029/ CVE-2019-1003029 — Jenkins Plugins 2022-04-25T00:00:00Z Apply the security update from Jenkins. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on April 25, 2022. https://exploit-radar.com/en/cve/CVE-2019-1003030/ CVE-2019-1003030 — Jenkins Plugins 2022-03-25T00:00:00Z Apply the security update from Jenkins. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2017-9841/ CVE-2017-9841 — PHPUnit 2022-02-15T00:00:00Z Apply the security update from PHPUnit. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on February 15, 2022. https://exploit-radar.com/en/cve/CVE-2018-1000861/ CVE-2018-1000861 — Jenkins Core 2022-02-10T00:00:00Z Apply the security update from Jenkins. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on February 10, 2022. https://exploit-radar.com/en/cve/CVE-2019-7238/ CVE-2019-7238 — Sonatype Nexus Repository 2021-12-10T00:00:00Z Apply the security update from Sonatype. CISA deadline: 182 days. Added to CISA’s catalog of exploited vulnerabilities on December 10, 2021. https://exploit-radar.com/en/cve/CVE-2021-22205/ CVE-2021-22205 — GitLab Community / Enterprise Edition (CE/EE) 2021-11-03T00:00:00Z Apply the security update from GitLab. CISA deadline: 14 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2020-10199/ CVE-2020-10199 — Sonatype Nexus Repository 2021-11-03T00:00:00Z Apply the security update from Sonatype. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021. https://exploit-radar.com/en/cve/CVE-2019-15752/ CVE-2019-15752 — Docker Desktop 2021-11-03T00:00:00Z Apply the security update from Docker. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on November 3, 2021.