PatchTheCVEmit vulnerabilities
Recent CVEs affecting mit products. 16 tracked.
mit has 16 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-09-03. Highest priority: CVE-2026-85425 (score 62/100).
- CVE-2026-40356 MEDIUM 5.9 UPGRADE In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if
- CVE-2026-40355 MEDIUM 5.9 UPGRADE In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_ac
- CVE-2026-85456 MEDIUM 5.5 UPGRADE MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandle
- CVE-2026-85449 HIGH 7.5 UPGRADE MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT me
- CVE-2026-85448 HIGH 7.5 UPGRADE MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel ve
- CVE-2026-85447 HIGH 7.5 UPGRADE MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating durati
- CVE-2026-85446 HIGH 7.5 UPGRADE MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new
- CVE-2026-85445 HIGH 7.5 UPGRADE MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function tha
- CVE-2026-85444 HIGH 7.5 UPGRADE MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned()
- CVE-2026-85439 HIGH 7.8 UPGRADE MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreC
- CVE-2026-85438 CRITICAL 9.8 UPGRADE MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, pie
- CVE-2026-85437 CRITICAL 9.8 UPGRADE MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that
- CVE-2026-85435 CRITICAL 9.1 UPGRADE MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle
- CVE-2026-85434 CRITICAL 9.1 UPGRADE MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge
- CVE-2026-85429 HIGH 7.5 UPGRADE MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than valida
- CVE-2026-85425 CRITICAL 9.8 UPGRADE MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler t
FAQ
How do I fix mit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mit being exploited right now?
None of the tracked mit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mit CVE should I patch first?
CVE-2026-85425 currently ranks highest (62/100): MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler t.