CISA

CISA, the Cybersecurity and Infrastructure Security Agency, is part of the U.S. Department of Homeland Security. It leads cybersecurity for the federal civilian government and coordinates protection of U.S. critical infrastructure. Its Known Exploited Vulnerabilities catalog lists CVEs that CISA has confirmed are being exploited and that pose a significant risk to federal systems. Each row includes a due date for federal civilian agencies to apply the fix.

A Unity editor version, a package, or a native plugin can show up in the Known Exploited Vulnerabilities catalog under its CVE. That row means CISA has confirmed the flaw is being exploited, so that version is the one to update first. The catalog is public. The due date on a row is the one set for federal civilian agencies.

Before a release you search the CISA catalog for the packages in your project. One version is listed under its CVE, which means CISA has confirmed that flaw is being exploited. You update that package in this release.

• CVE

Cybersecurity and Infrastructure Security Agency