While CISA says the catalog is catching on, some think it needs improvement.

Five zero-days found in Aethon TUG robots included one that could allow an attacker to control the machines, Cynerio said.

Web applications created in the Spring platform could leave users open to remote code execution, CISA and others are warning.

CISA wants agencies to tackle nearly 300 flaws in all, ranging from within two weeks to six months.

It's the kind of access the NSA has described as a "dream" for Russian hackers.

There are reports hackers have been exploiting the bugs.