Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

58 results · page 2 of 2

Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Feb 22, 2022Zabbix Frontend Improper Access Control VulnerabilityCVE-2022-23134 · Other software · Zabbix · reported by security@zabbix.comExploitedLow 3.7
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
Product
Frontend
On CISA’s list since
Feb 22, 2022 (federal fix deadline Mar 8, 2022)
What to do
Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.debian.org lists.fedoraproject.org
Jan 10, 2022VMware vCenter Server Improper Access ControlCVE-2021-22017 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Product
vCenter Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Dec 10, 2021Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Product
Nexus Repository Manager
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.sonatype.com support.sonatype.com
Nov 3, 2021ForgeRock Access Management (AM) Core Server Remote Code Execution VulnerabilityCVE-2021-35464 · Other software · ForgeRock · reported by MITREExploitedRansomwareCritical 9.8
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
Product
Access Management (AM)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install ForgeRock’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Micro Focus Access Manager Information Leakage VulnerabilityCVE-2021-22506 · Other software · Micro Focus · reported by security@opentext.comExploitedHigh 7.5
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
Product
Micro Focus Access Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Micro Focus’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog microfocus.com microfocus.com
Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityCVE-2020-26919 · Network & remote access · NETGEAR · reported by MITREExploitedCritical 9.8
Netgear JGS516PE devices contain a missing function level access control vulnerability.
Product
JGS516PE Devices
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.netgear.com kb.netgear.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.