Updated 57 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

357new WordPress flaws this week

394,273entries in the database

683 results · page 14 of 14

Nov 3, 2021Unraid Authentication Bypass VulnerabilityCVE-2020-5849 · Other software · Unraid · reported by MITREExploitedHigh 7.5
Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.
Product
Unraid
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Unraid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.unraid.net
Nov 3, 2021vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2019-16759 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Product
vBulletin
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2020-17496 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
Product
vBulletin
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.exploitee.rs cwe.mitre.org
Nov 3, 2021VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityCVE-2019-5544 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
Product
VMware ESXi and Horizon DaaS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Nov 3, 2021Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityCVE-2021-40539 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com manageengine.com
Nov 3, 2021Zoho ManageEngine Desktop Central File Upload VulnerabilityCVE-2020-10189 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org
Nov 3, 2021Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityCVE-2020-29583 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp.zyxel.com businessforum.zyxel.com
Nov 3, 2021Adobe Acrobat and Reader Heap-based Buffer Overflow VulnerabilityCVE-2021-21017 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Product
Acrobat and Reader
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Nov 3, 2021Microsoft Exchange Server Privilege Escalation VulnerabilityCVE-2021-34523 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2020-17144 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.4
Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Apache Struts Remote Code Execution VulnerabilityCVE-2018-11776 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com arubanetworks.com
Nov 3, 2021Apple iOS, iPadOS, and watchOS Out-of-Bounds Write VulnerabilityCVE-2020-9818 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Nov 3, 2021Apple iOS, iPadOS, and watchOS Memory Corruption VulnerabilityCVE-2020-9819 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 4.3
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Nov 3, 2021SolarWinds Orion Authentication Bypass VulnerabilityCVE-2020-10148 · Other software · SolarWinds · reported by cret@cert.orgExploitedCritical 9.8
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
Product
Orion
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.cert.org solarwinds.com
Nov 3, 2021Zoho ManageEngine ServiceDesk Plus (SDP) File Upload VulnerabilityCVE-2019-8394 · Email & office · Zoho · reported by MITREExploitedMedium 6.5
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Nov 3, 2021Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) VulnerabilityCVE-2021-1879 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.1
Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Nov 3, 2021Adobe Flash Player Use-After-Free VulnerabilityCVE-2018-4878 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Product
Flash Player
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.talosintelligence.com securityfocus.com
Nov 3, 2021Apache HTTP Server Privilege Escalation VulnerabilityCVE-2019-0211 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.8
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Product
HTTP Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Nov 3, 2021Apache Shiro Code Execution VulnerabilityCVE-2016-4437 · Websites & servers · Apache · reported by Red HatExploitedCritical 9.8
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
Product
Shiro
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Apache Solr VelocityResponseWriter Plug-In Remote Code Execution VulnerabilityCVE-2019-17558 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5
The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.
Product
Solr
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com issues.apache.org
Nov 3, 2021Arcadyan Buffalo Firmware Path Traversal VulnerabilityCVE-2021-20090 · Network & remote access · Arcadyan · reported by vulnreport@tenable.comExploitedCritical 9.8
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Product
Buffalo Firmware
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arcadyan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.cert.org secpod.com
Nov 3, 2021Apache Struts Remote Code Execution VulnerabilityCVE-2020-17530 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp packetstormsecurity.com
Nov 3, 2021Apache Struts Remote Code Execution VulnerabilityCVE-2017-5638 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.talosintelligence.com blog.trendmicro.com
Nov 3, 2021Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityCVE-2020-12812 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
Product
FortiOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Nov 3, 2021Fortinet FortiOS SSL VPN Path Traversal VulnerabilityCVE-2018-13379 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.1
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Product
FortiOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Nov 3, 2021Mediatek Multiple Chipsets Insufficient Input Validation VulnerabilityCVE-2020-0069 · Computers, phones & browsers · MediaTek · reported by security@android.comExploitedHigh 7.8
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
Product
Multiple Chipsets
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install MediaTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huawei.com source.android.com
Nov 3, 2021Apache Struts Deserialization of Untrusted Data VulnerabilityCVE-2017-9805 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Nov 3, 2021Apache HTTP Server Path Traversal VulnerabilityCVE-2021-42013 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Product
HTTP Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp packetstormsecurity.com
Nov 3, 2021Microsoft Enhanced Cryptographic Provider Privilege Escalation VulnerabilityCVE-2021-31201 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.2
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
Product
Enhanced Cryptographic Provider
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Arm Mali Graphics Processing Unit (GPU) Unspecified VulnerabilityCVE-2021-28664 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Nov 3, 2021Arm Mali Graphics Processing Unit (GPU) Use-After-Free VulnerabilityCVE-2021-28663 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Nov 3, 2021Atlassian Confluence Server and Data Center Path Traversal VulnerabilityCVE-2019-3398 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedHigh 8.8
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
Product
Confluence Server and Data Center
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityCVE-2021-26084 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Product
Confluence Server and Data Center
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.