Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

407 results · page 2 of 9

Mar 27, 2026F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityCVE-2025-53521 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.3
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Product
BIG-IP
On CISA’s list since
Mar 27, 2026 (federal fix deadline Mar 30, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog my.f5.com cisa.gov
Mar 18, 2026Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilityCVE-2025-66376 · Email & office · Synacor · reported by MITREExploitedHigh 7.2
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Mar 18, 2026 (federal fix deadline Apr 1, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Mar 13, 2026Google Skia Out-of-Bounds Write VulnerabilityCVE-2026-3909 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Product
Skia
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8n · reported by GitHubExploitedCritical 9.9
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Product
n8n
On CISA’s list since
Mar 11, 2026 (federal fix deadline Mar 25, 2026)
What to do
Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 9, 2026Omnissa Workspace ONE Server-Side Request ForgeryCVE-2021-22054 · Other software · Omnissa · reported by security@vmware.comExploitedHigh 7.5
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Product
Workspace One UEM
On CISA’s list since
Mar 9, 2026 (federal fix deadline Mar 23, 2026)
What to do
Attackers are using this now. Install Omnissa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Mar 5, 2026Apple iOS and iPadOS Use-After-Free VulnerabilityCVE-2023-41974 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 5, 2026Apple Multiple products Use-After-Free VulnerabilityCVE-2023-43000 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 25, 2026Cisco SD-WAN Path Traversal VulnerabilityCVE-2022-20775 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Product
SD-WAN
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com github.com
Feb 25, 2026Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCVE-2026-20127 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Product
Catalyst SD-WAN Controller and Manager
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Feb 20, 2026RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
Product
Webmail
On CISA’s list since
Feb 20, 2026 (federal fix deadline Mar 13, 2026)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com roundcube.net
Feb 18, 2026GitLab Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-22175 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedMedium 6.8
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
Product
GitLab
On CISA’s list since
Feb 18, 2026 (federal fix deadline Mar 11, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com gitlab.com
Feb 18, 2026Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCVE-2026-22769 · Other software · Dell · reported by security_alert@emc.comExploitedCritical 10
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
Product
RecoverPoint for Virtual Machines (RP4VMs)
On CISA’s list since
Feb 18, 2026 (federal fix deadline Feb 21, 2026)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dell.com cloud.google.com
Feb 17, 2026Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilityCVE-2020-7796 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Product
Zimbra Collaboration Suite
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Feb 17, 2026TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2024-7694 · Other software · TeamT5 · reported by twcert@cert.org.twExploitedHigh 7.2
TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
Product
ThreatSonar Anti-Ransomware
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install TeamT5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
Feb 17, 2026Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Feb 3, 2026GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-39935 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedMedium 6.8
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
Product
Community and Enterprise Editions
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com gitlab.com
Jan 23, 2026Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityCVE-2024-37079 · Other software · Broadcom · reported by security@vmware.comExploitedCritical 9.8
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
Product
VMware vCenter Server
On CISA’s list since
Jan 23, 2026 (federal fix deadline Feb 13, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Jan 22, 2026Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityCVE-2025-54313 · Other software · Prettier · reported by MITREExploitedHigh 7.5
Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Product
eslint-config-prettier
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Prettier’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com news.ycombinator.com
Dec 22, 2025Digiever DS-2105 Pro Missing Authorization VulnerabilityCVE-2023-52163 · Other software · Digiever · reported by MITREExploitedHigh 8.8
Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.
Product
DS-2105 Pro
On CISA’s list since
Dec 22, 2025 (federal fix deadline Jan 12, 2026)
What to do
Attackers are using this now. Install Digiever’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog akamai.com txone.com
Dec 15, 2025Apple Multiple Products Use-After-Free WebKit VulnerabilityCVE-2025-43529 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Dec 15, 2025 (federal fix deadline Jan 5, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Dec 8, 2025D-Link Routers Buffer Overflow VulnerabilityCVE-2022-37055 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Routers
On CISA’s list since
Dec 8, 2025 (federal fix deadline Dec 29, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog drive.google.com supportannouncement.us.dlink.com
Nov 28, 2025OpenPLC ScadaBR Cross-site Scripting VulnerabilityCVE-2021-26829 · Other software · OpenPLC · reported by MITREExploitedMedium 5.4
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
Product
ScadaBR
On CISA’s list since
Nov 28, 2025 (federal fix deadline Dec 19, 2025)
What to do
Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.scadabr.com.br youtu.be
Nov 12, 2025WatchGuard Firebox Out-of-Bounds Write VulnerabilityCVE-2025-9242 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3ExploitedCritical 9.3
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
Product
Firebox
On CISA’s list since
Nov 12, 2025 (federal fix deadline Dec 3, 2025)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.watchguard.com watchguard.com
Nov 10, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21042 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 8.8
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Product
Mobile Devices
On CISA’s list since
Nov 10, 2025 (federal fix deadline Dec 1, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com unit42.paloaltonetworks.com
Oct 20, 2025Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61884 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareHigh 7.5
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
Product
E-Business Suite
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com blogs.oracle.com
Oct 7, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCVE-2025-27915 · Email & office · Synacor · reported by MITREExploitedMedium 5.4
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 7, 2025 (federal fix deadline Oct 28, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Oct 6, 2025Linux Kernel Heap Out-of-Bounds Write VulnerabilityCVE-2021-22555 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comExploitedHigh 8.3
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
Product
Kernel
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Oct 6, 2025Microsoft Windows Out-of-Bounds Write VulnerabilityCVE-2013-3918 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com darkreading.com
Oct 6, 2025Oracle E-Business Suite Unspecified VulnerabilityCVE-2025-61882 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
Product
E-Business Suite
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com blogs.oracle.com
Oct 2, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21043 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 8.8
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
Product
Mobile Devices
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com cisa.gov
Sep 29, 2025Adminer Server-Side Request Forgery VulnerabilityCVE-2021-21311 · Other software · Adminer · reported by GitHubExploitedHigh 7.2
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
Product
Adminer
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Adminer’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 4, 2025Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityCVE-2025-38352 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Product
Kernel
On CISA’s list since
Sep 4, 2025 (federal fix deadline Sep 25, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 4, 2025Android Runtime Use-After-Free VulnerabilityCVE-2025-48543 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 8.8
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
Product
Runtime
On CISA’s list since
Sep 4, 2025 (federal fix deadline Sep 25, 2025)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog android.googlesource.com source.android.com
Sep 3, 2025TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityCVE-2023-50224 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comExploitedMedium 6.5
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
TL-WR841N
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-Link · reported by f23511db-6c3e-4e32-a477-6aa17d310630ExploitedHigh 8.6
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Sep 2, 2025TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityCVE-2020-24363 · Network & remote access · TP-Link · reported by MITREExploitedHigh 8.8
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
TL-WA855RE
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog malwrforensics.com pastebin.com
Aug 21, 2025Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityCVE-2025-43300 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 10
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Aug 21, 2025 (federal fix deadline Sep 11, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 13, 2025N-able N-Central Command Injection VulnerabilityCVE-2025-8876 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
Product
N-Central
On CISA’s list since
Aug 13, 2025 (federal fix deadline Aug 20, 2025)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.n-able.com cisa.gov
Aug 13, 2025N-able N-Central Insecure Deserialization VulnerabilityCVE-2025-8875 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
Product
N-Central
On CISA’s list since
Aug 13, 2025 (federal fix deadline Aug 20, 2025)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.n-able.com cisa.gov
Aug 5, 2025D-Link DCS-2530L and DCS-2670L Devices Unspecified VulnerabilityCVE-2020-25078 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.5
D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DCS-2530L and DCS-2670L Devices
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com twitter.com
Aug 5, 2025D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityCVE-2020-25079 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DCS-2530L and DCS-2670L Devices
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com twitter.com
Aug 5, 2025D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityCVE-2022-40799 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DNR-322L
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com gitlab.com
Jul 28, 2025PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityCVE-2023-2533 · Other software · PaperCut · reported by help@fluidattacks.comExploitedHigh 8.4
PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.
Product
NG/MF
On CISA’s list since
Jul 28, 2025 (federal fix deadline Aug 18, 2025)
What to do
Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fluidattacks.com papercut.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2775 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2776 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 10, 2025Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCVE-2025-5777 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.3
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jul 10, 2025 (federal fix deadline Jul 11, 2025)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com citrixbleed.com
Jul 7, 2025Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilityCVE-2019-9621 · Email & office · Synacor · reported by MITREExploitedHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jul 7, 2025Multi-Router Looking Glass (MRLG) Buffer Overflow VulnerabilityCVE-2014-3931 · Other software · Looking Glass · reported by MITREExploitedCritical 9.8
Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.
Product
Multi-Router Looking Glass (MRLG)
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Looking Glass’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mrlg.op-sec.us s3.eurecom.fr
Jun 25, 2025Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityCVE-2019-6693 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 6.5
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Product
FortiOS
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jun 25, 2025 D-Link DIR-859 Router Path Traversal VulnerabilityCVE-2024-0769 · Network & remote access · D-Link · reported by VulDBExploitedMedium 5.3
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Product
DIR-859 Router
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.