Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,139 results · page 19 of 23

Jan 18, 2022October CMS Improper AuthenticationCVE-2021-32648 · Other software · October CMS · reported by GitHubExploitedHigh 8.2
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Product
October CMS
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install October CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25296 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25297 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25298 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Microsoft Exchange Server Information DisclosureCVE-2021-33766 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Product
Exchange Server
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Jan 18, 2022VMware Server Side Request Forgery in vRealize Operations Manager APICVE-2021-21975 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 7.5
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Product
vRealize Operations Manager API
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Jan 18, 2022System Information Library for Node.JS Command InjectionCVE-2021-21315 · Other software · Npm package · reported by GitHubExploitedHigh 7.1
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Product
System Information Library for Node.JS
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Npm package’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jan 18, 2022Oracle Business Intelligence Enterprise Edition Path TransversalCVE-2020-14864 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Product
Intelligence Enterprise Edition
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Jan 18, 2022Apache Airflow Command InjectionCVE-2020-11978 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Product
Airflow
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Apache Airflow's Experimental API Authentication BypassCVE-2020-13927 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Product
Airflow's Experimental API
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2022Hikvision Improper Input ValidationCVE-2021-36260 · Network & remote access · Hikvision · reported by hsrc@hikvision.comExploitedCritical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Product
Security cameras web server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2019-1458 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
Product
Win32k
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2022Microsoft WinVerifyTrust function Remote Code ExecutionCVE-2013-3900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Product
WinVerifyTrust function
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com blogs.technet.com
Jan 10, 2022Oracle WebLogic Server, InjectionCVE-2019-2725 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Product
WebLogic Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Jan 10, 2022Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceCVE-2019-9670 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com rapid7.com
Jan 10, 2022Fortinet FortiOS and FortiProxy Improper AuthorizationCVE-2018-13382 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.1
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jan 10, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2019-1579 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareHigh 8.1
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Product
PAN-OS
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com devco.re
Jan 10, 2022Exim Mail Transfer Agent (MTA) Improper Input ValidationCVE-2019-10149 · Other software · Exim · reported by Red HatExploitedCritical 9.8
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Product
Mail Transfer Agent (MTA)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
Jan 10, 2022IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.CVE-2015-7450 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.8
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Product
WebSphere Application Server and Server Hypervisor Edition
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog www-01.ibm.com www-01.ibm.com
Jan 10, 2022Primetek Primefaces Remote Code Execution VulnerabilityCVE-2017-1000486 · Other software · Primetek · reported by MITREExploitedCritical 9.8
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Product
Primefaces Application
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Primetek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.mindedsecurity.com cryptosense.com
Jan 10, 2022Kibana Arbitrary Code ExecutionCVE-2019-7609 · Other software · Elastic · reported by security@elastic.coExploitedCritical 10
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Product
Kibana
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Elastic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com access.redhat.com
Jan 10, 2022FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitCVE-2021-27860 · Other software · FatPipe · reported by cret@cert.orgExploitedCritical 9.8
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Product
WARP, IPVPN, and MPVPN software
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install FatPipe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fatpipeinc.com ic3.gov
Dec 10, 2021MongoDB mongo-express Remote Code Execution VulnerabilityCVE-2019-10758 · Other software · MongoDB · reported by report@snyk.ioExploitedCritical 9.9
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Product
mongo-express
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install MongoDB’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog snyk.io snyk.io
Dec 10, 2021Zoho Desktop Central Authentication Bypass VulnerabilityCVE-2021-44515 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Product
Desktop Central
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog pitstop.manageengine.com cisa.gov
Dec 10, 2021Realtek Jungle SDK Remote Code Execution VulnerabilityCVE-2021-35394 · Network & remote access · Realtek · reported by MITREExploitedCritical 9.8
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Product
Jungle Software Development Kit (SDK)
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog iot-inspector.com realtek.com
Dec 10, 2021Apache Solr DataImportHandler Code Injection VulnerabilityCVE-2019-0193 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.2
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Product
Solr
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Dec 10, 2021Embedthis GoAhead Remote Code Execution VulnerabilityCVE-2017-17562 · Other software · Embedthis · reported by MITREExploitedHigh 8.1
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Product
GoAhead
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Embedthis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securitytracker.com
Dec 10, 2021Red Hat JBoss Application Server Remote Code Execution VulnerabilityCVE-2017-12149 · Other software · Red Hat · reported by Red HatExploitedRansomwareCritical 9.8
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Product
JBoss Application Server
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Dec 10, 2021Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityCVE-2010-1871 · Other software · Red Hat · reported by MITREExploitedHigh 8.8
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
Product
JBoss Seam 2
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com redhat.com
Dec 10, 2021Fuel CMS SQL Injection VulnerabilityCVE-2020-17463 · Other software · Fuel CMS · reported by MITREExploitedCritical 9.8
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
Product
Fuel CMS
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Fuel CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org
Dec 10, 2021Pi-Hole AdminLTE Remote Code Execution VulnerabilityCVE-2020-8816 · Other software · Pi-hole · reported by MITREExploitedHigh 7.2
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Product
AdminLTE
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Pi-hole’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 10, 2021Apache Log4j2 Remote Code Execution VulnerabilityCVE-2021-44228 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 10
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Product
Log4j2
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 1, 2021Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
On CISA’s list since
Dec 1, 2021 (federal fix deadline Jun 1, 2022)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Dec 1, 2021Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityCVE-2021-37415 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
Product
ManageEngine ServiceDesk Plus (SDP)
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog manageengine.com manageengine.com
Dec 1, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Product
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com pitstop.manageengine.com
Nov 17, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-42321 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
Product
Exchange
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 17, 2021ExifTool Remote Code Execution VulnerabilityCVE-2021-22204 · Other software · Perl · reported by cve@gitlab.comExploitedMedium 6.8
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Product
Exiftool
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Perl’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 17, 2021Microsoft Windows Win32k Privilege Escalation VulnerabilityCVE-2021-40449 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Unspecified vulnerability allows for an authenticated user to escalate privileges.
Product
Windows
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Defender Remote Code Execution VulnerabilityCVE-2021-1647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.
Product
Defender
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow VulnerabilityCVE-2021-22894 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 8.8
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
Product
Pulse Connect Secure
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.pulsesecure.net kb.pulsesecure.net
Nov 3, 2021Apple Multiple Products Type Confusion VulnerabilityCVE-2020-27932 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 3, 2021Oracle Fusion Middleware Unspecified VulnerabilityCVE-2012-3152 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.1
Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.
Product
Fusion Middleware
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.netinfiltration.com blog.netinfiltration.com
Nov 3, 2021DotNetNuke (DNN) Remote Code Execution VulnerabilityCVE-2017-9822 · Other software · DotNetNuke (DNN) · reported by security-alert@hpe.comExploitedRansomwareHigh 8.8
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
Product
DotNetNuke (DNN)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install DotNetNuke (DNN)’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com dnnsoftware.com
Nov 3, 2021DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityCVE-2018-18325 · Other software · DotNetNuke (DNN) · reported by MITREExploitedHigh 7.5
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
Product
DotNetNuke (DNN)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install DotNetNuke (DNN)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Nov 3, 2021Nagios XI Remote Code Execution VulnerabilityCVE-2019-15949 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
Product
Nagios XI
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021SonicWall SMA100 SQL Injection VulnerabilityCVE-2019-7481 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareHigh 7.5
SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
Product
SMA100
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Nov 3, 2021Netis WF2419 Devices Remote Code Execution VulnerabilityCVE-2019-19356 · Other software · Netis · reported by MITREExploitedHigh 7.5
Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.
Product
WF2419 Devices
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Netis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Nov 3, 2021Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityCVE-2020-1020 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityCVE-2020-1380 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
Product
Internet Explorer
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Nov 3, 2021Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityCVE-2020-26919 · Network & remote access · NETGEAR · reported by MITREExploitedCritical 9.8
Netgear JGS516PE devices contain a missing function level access control vulnerability.
Product
JGS516PE Devices
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.netgear.com kb.netgear.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.