Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

365new WordPress flaws this week

13,868entries in the database

374 results · page 3 of 8

May 1, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2023-44221 · Network & remote access · SonicWallExploited
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Product
SMA100 Appliances
On CISA’s list since
May 1, 2025 (federal fix deadline May 22, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Apr 29, 2025SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2025-31324 · Network & remote access · SAPExploitedRansomware
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Product
NetWeaver
On CISA’s list since
Apr 29, 2025 (federal fix deadline May 20, 2025)
What to do
Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Apr 16, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2021-20035 · Network & remote access · SonicWallExploited
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Product
SMA100 Appliances
On CISA’s list since
Apr 16, 2025 (federal fix deadline May 7, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Apr 4, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-22457 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Apr 4, 2025 (federal fix deadline Apr 11, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 31, 2025Cisco Smart Licensing Utility Static Credential VulnerabilityCVE-2024-20439 · Network & remote access · CiscoExploited
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Product
Smart Licensing Utility
On CISA’s list since
Mar 31, 2025 (federal fix deadline Apr 21, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 19, 2025SAP NetWeaver Directory Traversal VulnerabilityCVE-2017-12637 · Network & remote access · SAPExploited
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Product
NetWeaver
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 18, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2025-24472 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Product
FortiOS and FortiProxy
On CISA’s list since
Mar 18, 2025 (federal fix deadline Apr 8, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 13, 2025Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityCVE-2025-21590 · Network & remote access · JuniperExploited
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
Product
Junos OS
On CISA’s list since
Mar 13, 2025 (federal fix deadline Apr 3, 2025)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13159 · Network & remote access · IvantiExploited
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13161 · Network & remote access · IvantiExploited
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13160 · Network & remote access · IvantiExploited
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2025Cisco Small Business RV Series Routers Command Injection VulnerabilityCVE-2023-20118 · Network & remote access · CiscoExploited
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
Product
Small Business RV Series Routers
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 20, 2025Palo Alto Networks PAN-OS File Read VulnerabilityCVE-2025-0111 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Product
PAN-OS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 18, 2025SonicWall SonicOS SSLVPN Improper Authentication VulnerabilityCVE-2024-53704 · Network & remote access · SonicWallExploitedRansomware
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
Product
SonicOS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 18, 2025Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2025-0108 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Product
PAN-OS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40891 · Network & remote access · ZyxelExploited
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40890 · Network & remote access · ZyxelExploited
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 6, 2025Sophos XG Firewall Buffer Overflow VulnerabilityCVE-2020-15069 · Network & remote access · SophosExploited
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
Product
XG Firewall
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 6, 2025CyberoamOS (CROS) SQL Injection VulnerabilityCVE-2020-29574 · Network & remote access · SophosExploitedRansomware
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
Product
CyberoamOS
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Jan 24, 2025SonicWall SMA1000 Appliances Deserialization VulnerabilityCVE-2025-23006 · Network & remote access · SonicWallExploitedRansomware
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
Product
SMA1000 Appliances
On CISA’s list since
Jan 24, 2025 (federal fix deadline Feb 14, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Jan 14, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2024-55591 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 14, 2025 (federal fix deadline Jan 21, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Jan 8, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-0282 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Jan 8, 2025 (federal fix deadline Jan 15, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Dec 30, 2024Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityCVE-2024-3393 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Product
PAN-OS
On CISA’s list since
Dec 30, 2024 (federal fix deadline Jan 20, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Dec 3, 2024Zyxel Multiple Firewalls Path Traversal VulnerabilityCVE-2024-11667 · Network & remote access · ZyxelExploitedRansomware
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
Product
Multiple Firewalls
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 25, 2024Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityCVE-2023-28461 · Network & remote access · Array Networks ExploitedRansomware
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
Product
AG/vxAG ArrayOS
On CISA’s list since
Nov 25, 2024 (federal fix deadline Dec 16, 2024)
What to do
Attackers are using this now. Install Array Networks ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityCVE-2024-0012 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityCVE-2024-9474 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 14, 2024Palo Alto Networks Expedition OS Command Injection VulnerabilityCVE-2024-9463 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Product
Expedition
On CISA’s list since
Nov 14, 2024 (federal fix deadline Dec 5, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 14, 2024Palo Alto Networks Expedition SQL Injection VulnerabilityCVE-2024-9465 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Product
Expedition
On CISA’s list since
Nov 14, 2024 (federal fix deadline Dec 5, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 12, 2024Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) VulnerabilityCVE-2014-2120 · Network & remote access · CiscoExploited
Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Nov 7, 2024Palo Alto Networks Expedition Missing Authentication VulnerabilityCVE-2024-5910 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
Product
Expedition
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 24, 2024Cisco ASA and FTD Denial-of-Service VulnerabilityCVE-2024-20481 · Network & remote access · CiscoExploited
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Oct 24, 2024 (federal fix deadline Nov 14, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 23, 2024Fortinet FortiManager Missing Authentication VulnerabilityCVE-2024-47575 · Network & remote access · FortinetExploited
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
FortiManager
On CISA’s list since
Oct 23, 2024 (federal fix deadline Nov 13, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 9, 2024Fortinet Multiple Products Format String VulnerabilityCVE-2024-23113 · Network & remote access · FortinetExploited
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
Multiple Products
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 9, 2024Ivanti Cloud Services Appliance (CSA) SQL Injection VulnerabilityCVE-2024-9379 · Network & remote access · IvantiExploited
Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 9, 2024Ivanti Cloud Services Appliance (CSA) OS Command Injection VulnerabilityCVE-2024-9380 · Network & remote access · IvantiExploited
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 2, 2024Ivanti Endpoint Manager (EPM) SQL Injection VulnerabilityCVE-2024-29824 · Network & remote access · IvantiExploited
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
Product
Endpoint Manager (EPM)
On CISA’s list since
Oct 2, 2024 (federal fix deadline Oct 23, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 30, 2024D-Link DIR-820 Router OS Command Injection VulnerabilityCVE-2023-25280 · Network & remote access · D-LinkExploited
D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Product
DIR-820 Router
On CISA’s list since
Sep 30, 2024 (federal fix deadline Oct 21, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 30, 2024DrayTek Multiple Vigor Routers OS Command Injection VulnerabilityCVE-2020-15415 · Network & remote access · DrayTekExploited
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
Product
Multiple Vigor Routers
On CISA’s list since
Sep 30, 2024 (federal fix deadline Oct 21, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 24, 2024Ivanti Virtual Traffic Manager Authentication Bypass VulnerabilityCVE-2024-7593 · Network & remote access · IvantiExploited
Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
Product
Virtual Traffic Manager
On CISA’s list since
Sep 24, 2024 (federal fix deadline Oct 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 19, 2024Ivanti Cloud Services Appliance (CSA) Path Traversal VulnerabilityCVE-2024-8963 · Network & remote access · IvantiExploited
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Sep 19, 2024 (federal fix deadline Oct 10, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 13, 2024Ivanti Cloud Services Appliance OS Command Injection VulnerabilityCVE-2024-8190 · Network & remote access · IvantiExploited
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance
On CISA’s list since
Sep 13, 2024 (federal fix deadline Oct 4, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 9, 2024SonicWall SonicOS Improper Access Control VulnerabilityCVE-2024-40766 · Network & remote access · SonicWallExploitedRansomware
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Product
SonicOS
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 3, 2024Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20123 · Network & remote access · DrayTekExploited
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Product
VigorConnect
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 3, 2024Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20124 · Network & remote access · DrayTekExploited
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Product
VigorConnect
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33044 · Network & remote access · DahuaExploited
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33045 · Network & remote access · DahuaExploited
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Jul 2, 2024Cisco NX-OS Command Injection VulnerabilityCVE-2024-20399 · Network & remote access · CiscoExploited
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.
Product
NX-OS
On CISA’s list since
Jul 2, 2024 (federal fix deadline Jul 23, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
May 30, 2024Check Point Quantum Security Gateways Information Disclosure VulnerabilityCVE-2024-24919 · Network & remote access · Check PointExploitedRansomware
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
Product
Quantum Security Gateways
On CISA’s list since
May 30, 2024 (federal fix deadline Jun 20, 2024)
What to do
Attackers are using this now. Install Check Point’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
May 16, 2024D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) VulnerabilityCVE-2014-100005 · Network & remote access · D-LinkExploited
D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.
Product
DIR-600 Router
On CISA’s list since
May 16, 2024 (federal fix deadline Jun 6, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.